Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
Zig is not affected by this vulnerability. While `zig.spec` declares `Provides: bundled(glibc) = 2.43` to account for embedded headers and ABI symbol metadata, Zig does not bundle or compile the GNU C Library implementation of `fopen` (or `libio` where the `,ccs=` parsing flaw resides). Specifically: - Zig only ships glibc ABI symbol tables (`abilists`) to generate compile-time dynamic linking stubs (`.so`), generic headers, and minimal C runtime startup objects (`crt1.o`, `elf-init`, `stat` shims). - Zig compiler binaries and generated executables dynamically link against the host/target system's runtime `libc.so.6`. Closing as NOTABUG.