diff --git a/glibc.spec b/glibc.spec
index 46b8fc3..a14e8bb 100644
--- a/glibc.spec
+++ b/glibc.spec
@@ -1,4 +1,4 @@
-%global glibcsrcdir glibc-2.38-41-gcfe1219100
+%global glibcsrcdir glibc-2.38-44-gd37c2b20a4
 %global glibcversion 2.38
 # Pre-release tarballs are pulled in from git using a command that is
 # effectively:
@@ -159,7 +159,7 @@ Version: %{glibcversion}
 # - It allows using the Release number without the %%dist tag in the dependency
 #   generator to make the generated requires interchangeable between Rawhide
 #   and ELN (.elnYY < .fcXX).
-%global baserelease 15
+%global baserelease 16
 Release: %{baserelease}%{?dist}
 
 # In general, GPLv2+ is used by programs, LGPLv2+ is used for
@@ -2202,6 +2202,13 @@ update_gconv_modules_cache ()
 %files -f compat-libpthread-nonshared.filelist -n compat-libpthread-nonshared
 
 %changelog
+* Tue Jan 30 2024 Patsy Griffin <patsy@redhat.com> - 2.38-16
+- Auto-sync with upstream branch release/2.38/master,
+  commit d37c2b20a4787463d192b32041c3406c2bd91de0:
+- syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)
+- syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6779)
+- syslog: Fix heap buffer overflow in __vsyslog_internal (CVE-2023-6246)
+
 * Mon Jan 29 2024 Arjun Shankar <arjun@redhat.com> - 2.38-15
 - Adjust glibc-implicit-object-deps-3.patch; and
 - Auto-sync with upstream branch release/2.38/master,
diff --git a/sources b/sources
index dea68cd..005789d 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (glibc-2.38-41-gcfe1219100.tar.xz) = 86dc2dcb1d2aaab519b05e566e2e79dcb45ceefded0805870252affc6074f1b8784d97d9d9e1a32cb2937525b0aea6a021c36e29189f8d31ae48ceed0e49a527
+SHA512 (glibc-2.38-44-gd37c2b20a4.tar.xz) = 3596847184a28acb467e17824e2900db4734f32678decf234f61ce282997799b0448d22e24c897150a01e7e485a8df7af6346364a734ecb8b3c15a2bb6d13f47