[PATCH] Add advisory text for CVE-2025-15281

[Adhemerval Zanella Netto]

On 20/01/26 11:37, Carlos O'Donell wrote:
> On 1/20/26 9:33 AM, Adhemerval Zanella Netto wrote:
>>
>>
>> On 20/01/26 11:32, Siddhesh Poyarekar wrote:
>>> On 2026-01-20 08:42, Carlos O'Donell wrote:
>>>> Explain the security issue and set context for the vulnerability to help
>>>> downstreams get a better understanding of the issue.
>>>> ---
>>>>    advisories/GLIBC-SA-2026-0003 | 23 +++++++++++++++++++++++
>>>>    1 file changed, 23 insertions(+)
>>>>    create mode 100644 advisories/GLIBC-SA-2026-0003
>>>
>>> Reviewed-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
>>>
>>>> diff --git a/advisories/GLIBC-SA-2026-0003 b/advisories/GLIBC-SA-2026-0003
>>>> new file mode 100644
>>>> index 0000000000..6f78548dfb
>>>> --- /dev/null
>>>> +++ b/advisories/GLIBC-SA-2026-0003
>>>> @@ -0,0 +1,23 @@
>>>> +wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory
>>>> +
>>>> +Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the
>>>> +GNU C Library version 2.0 to version 2.42 may cause the interface to
>>>> +return uninitialized memory in the we_wordv member, which on subsequent
>>>> +calls to wordfree may abort the process.
>>>> +
>>>> +The implementation of WRDE_REUSE in conjunction with WRDE_APPEND fails
>>>> +to clear the we_wordc member of the structure, and as such, when new
>>>> +words are added internally, a leading we_wordc count number of entries
>>>> +are skipped since they are assumed initialized.  These skipped entries
>>>> +are not initialized, but are the contents of a realloc-expanded array of
>>>> +pointers.  If the caller inspects the we_wordv array, it will
>>>> +dereference invalid pointers and crash. If the caller calls wordfree,
>>>> +the malloc implementation may detect the invalid pointers and abort the
>>>> +process.  Calls to wordexp using WRDE_REUSE and WRDE_APPEND have never
>>>> +worked correctly and thus the existence of applications that make use of
>>>> +this feature is unlikley.
>>>> +
>>>> +CVE-Id: CVE-2025-15281
>>>> +Public-Date: 2026-01-20
>>>> +Vulnerable-Commit: 8f2ece695d8822e9ecc63ecd157e90bf17a6fe65
>>>
>>> I assume you (or Adhemerval) will update this later using process-advisories.sh.
>>
>> I can do it.
>>
> 
> Thanks. Yes, someone needs to update the advisory once we get the fixed commit.
> 

I will commit this to master and start to backports.