CVE-2025-0395

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.(CVE-2025-0395)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

• SECURITY UPDATE: insufficient space allocation in assert() function leading to buffer overflow
  • debian/patches/any/CVE-2025-0395.patch: Fix underallocation of abort_msg_s struct to store the length of the message string
  • CVE-2025-0395

• SECURITY UPDATE: insufficient space allocation in assert() function leading to buffer overflow
  • debian/patches/any/CVE-2025-0395.patch: Fix underallocation of abort_msg_s struct to store the length of the message string
  • CVE-2025-0395

• CVE-2025-0395: fix underallocation of abort_msg_s struct that could lead to buffer overflow when printing assertion failures

• CVE-2025-0395: fix buffer underallocation in assert() and libc_fatal() mmap handling

• CVE-2025-0395: fix buffer underallocation in assert() and libc_fatal() mmap handling

• CVE-2025-0395: fix buffer underallocation in assert() and libc_fatal() mmap handling

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size. (CVE-2025-0395)

These are all security issues fixed in the glibc-2.41-1.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

Security fixes:

• CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
• CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow (bsc#1256766).
• CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in _nss_dns_getnetbyaddr_r (bsc#1256822).
• CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).

Other fixes:

• NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)

This update for glibc fixes the following issue:

• CVE-2025-0395: Fix underallocation of abort_msg_s struct (bsc#1236282, BZ #32582))

• s390x-wcsncmp patch: s390x: Fix segfault in wcsncmp (bsc#1228044).

This update for glibc fixes the following issues:

• CVE-2025-0395: Fix underallocation of abort_msg_s struct (bsc#1236282)

This update for glibc fixes the following issues:

• CVE-2025-0395: Fix underallocation of abort_msg_s struct (bsc#1236282)

This update for glibc fixes the following issues:

• CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).

Other fixes:

• Fix underallocation of abort_msg_s struct
• Correctly determine livepatching support
• Remove nss-systemd from default nsswitch.conf (bsc#1233699)

This update for glibc fixes the following issues:

• CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).

This update for glibc fixes the following issues:

Security fixes:

• CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
• CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow (bsc#1256766).
• CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in _nss_dns_getnetbyaddr_r (bsc#1256822).
• CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).

Other fixes:

• NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)

This update for glibc fixes the following issues:

Security fixes:

• CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
• CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow (bsc#1256766).
• CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in _nss_dns_getnetbyaddr_r (bsc#1256822).
• CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).

Other fixes:

• NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)

This update for glibc fixes the following issues:

Security fixes:

• CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
• CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow (bsc#1256766).
• CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in _nss_dns_getnetbyaddr_r (bsc#1256822).
• CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).

Other fixes:

• NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)

It was discovered that GNU C Library incorrectly handled memory when using the assert function. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

USN-7259-1 fixed a vulnerability in GNU C Library. This update provides the corresponding update for Ubuntu 16.04 LTS.

Original advisory details:

It was discovered that GNU C Library incorrectly handled memory when using the assert function. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

USN-7259-1 fixed a vulnerability in GNU C Library. This update provides the corresponding update for Ubuntu 14.04 LTS.

Original advisory details:

It was discovered that GNU C Library incorrectly handled memory when using the assert function. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.