Updated: 2024-11-30 03:59:26.363901
Description:
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.
| Links | NIST | CIRCL | RHEL | Ubuntu |
| Severity | Score | |
|---|---|---|
| CVSS Version 2.x | MEDIUM | 5 |
| CVSS Version 3.x | HIGH | 7.5 |
| OS name | Project name | Version | Score | Severity | Status | Errata | Last updated | Statement |
|---|---|---|---|---|---|---|---|---|
| AlmaLinux 9.2 ESU | glibc | 2.34 | 7.5 | HIGH | Not Vulnerable | 2023-11-08 08:36:05 | ||
| CentOS 6 ELS | glibc | 2.12 | 7.5 | HIGH | Released | CLSA-2021:1637583639 | 2022-05-05 12:02:18 | |
| CloudLinux 6 ELS | glibc | 2.12 | 7.5 | HIGH | Released | 2022-04-07 13:05:43 | ||
| Oracle Linux 6 ELS | glibc | 2.12 | 7.5 | HIGH | Released | CLSA-2021:1636389447 | 2021-11-08 11:50:03 | |
| Ubuntu 16.04 ELS | glibc | 2.23-0 | 7.5 | HIGH | Released | CLSA-2021:1636389414 | 2021-11-08 11:50:03 |