MediumFix available
glibc — security advisory
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
- Products
- glibc
- Affected versions
- Not specified
- Fixed versions
- 2.28-6
- CVEs
- CVE-2019-7309
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:30 UTC · Revision 1
Source evidence
In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.
osv:DEBIAN-CVE-2019-7309
glibc
Fixed versions: 2.28-6
glibc
Fixed versions: 2.28-6
glibc
Fixed versions: 2.28-6
Complete source record
{
"id": "9d4a920ef8420b354542eec5b0677a105225da29fb294513c4ab52a7d6f24c6a",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2019-7309",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2019-7309",
"summary": "In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.",
"evidence": "osv:DEBIAN-CVE-2019-7309",
"products": [
{
"name": {
"value": "glibc",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.28-6",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "glibc",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.28-6",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "glibc",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.28-6",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2019-7309",
"aliases": [
"DEBIAN-CVE-2019-7309"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.28-6"
}
]
}
],
"package": {
"name": "glibc",
"purl": "pkg:deb/debian/glibc?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-7309.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.28-6"
}
]
}
],
"package": {
"name": "glibc",
"purl": "pkg:deb/debian/glibc?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-7309.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.28-6"
}
]
}
],
"package": {
"name": "glibc",
"purl": "pkg:deb/debian/glibc?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2019-7309.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
}
],
"modified": "2026-10-15T07:47:40.030105480Z",
"provider": "osv",
"upstream": [
"CVE-2019-7309"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2019-7309"
]
},
"related_cves": [
{
"value": "CVE-2019-7309",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 322363,
"published_at": "2019-02-03T02:29:00.237+00:00"
}