764176 – (CVE-2019-25013) <sys-libs/glibc-2.32-r7: buffer overread in iconv (CVE-2019-25013)

Bug 764176 (CVE-2019-25013) - <sys-libs/glibc-2.32-r7: buffer overread in iconv (CVE-2019-25013)

Summary: <sys-libs/glibc-2.32-r7: buffer overread in iconv (CVE-2019-25013)

Status:	RESOLVED FIXED

Alias:	CVE-2019-25013

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	A4 [glsa+ cve]
Keywords:

Depends on:	CVE-2020-27618, CVE-2021-3326
Blocks:
	Show dependency tree

Reported:	2021-01-06 20:34 UTC by John Helmert III
Modified:	2021-07-06 03:41 UTC (History)
CC List:	1 user (show)

See Also:
Package list:	sys-libs/glibc-2.32-r7
Runtime testing required:	---

Flags:	nattka: sanity-check-

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2021-01-06 20:34:32 UTC

CVE-2019-25013 (https://sourceware.org/bugzilla/show_bug.cgi?id=24973):

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

Patch: https://sourceware.org/git/?p=glibc.git;a=commit;h=ee7a3144c9922808181009b7b3e50e852fb4999b

Not in any release.

Comment 1 Larry the Git Cow gentoo-dev

2021-01-07 11:24:39 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0e486a3e2bcba51de8672b544186e147079cdff0

commit 0e486a3e2bcba51de8672b544186e147079cdff0
Author:     Andreas K. Huettel <dilfridge@gentoo.org>
AuthorDate: 2021-01-07 11:24:02 +0000
Commit:     Andreas K. Huettel <dilfridge@gentoo.org>
CommitDate: 2021-01-07 11:24:27 +0000

    sys-libs/glibc: Patchlevel bump
    
    Bug: https://bugs.gentoo.org/764176
    Bug: https://bugs.gentoo.org/763618
    Package-Manager: Portage-3.0.12, Repoman-3.0.2
    Signed-off-by: Andreas K. Huettel <dilfridge@gentoo.org>

 sys-libs/glibc/Manifest             |    1 +
 sys-libs/glibc/glibc-2.32-r7.ebuild | 1513 +++++++++++++++++++++++++++++++++++
 2 files changed, 1514 insertions(+)

Comment 2 Sam James archtester

2021-02-24 22:54:17 UTC

Ready to stable? In tree since 7th Jan.

Comment 3 Andreas K. Hüttel archtester

2021-02-27 17:20:05 UTC

(In reply to Sam James from comment #2)
> Ready to stable? In tree since 7th Jan.

Why not.

Comment 4 Rolf Eike Beer archtester

2021-02-28 11:37:39 UTC

hppa/sparc stable

Comment 5 Sam James archtester

2021-02-28 15:57:49 UTC

amd64 done

Comment 6 Sam James archtester

2021-02-28 16:00:07 UTC

x86 done

Comment 7 Sam James archtester

2021-02-28 21:33:40 UTC

arm64 done

Comment 8 Sam James archtester

2021-03-03 21:32:10 UTC

arm done

Comment 9 Agostino Sarubbo gentoo-dev

2021-03-26 15:06:06 UTC

s390 stable

Comment 10 Andreas K. Hüttel archtester

2021-04-02 10:14:45 UTC

@ppc, ppc64: ping

Comment 11 Georgy Yakovlev archtester

2021-05-15 18:43:54 UTC

some tests still fail, but I checked and it seems due to kernel bug. debian disables those

FAIL: signal/tst-minsigstksz-1
FAIL: signal/tst-minsigstksz-2
FAIL: signal/tst-minsigstksz-3
FAIL: signal/tst-minsigstksz-3a
FAIL: signal/tst-minsigstksz-4

ppc and ppc64 done.

Comment 12 NATTkA bot gentoo-dev

2021-06-08 07:20:27 UTC

Unable to check for sanity:

> no match for package: sys-libs/glibc-2.32-r7

Comment 13 Andreas K. Hüttel archtester

2021-07-01 21:31:37 UTC

Nothing to do for toolchain here anymore

Comment 14 John Helmert III archtester

2021-07-05 02:39:00 UTC

New request filed

Comment 15 GLSAMaker/CVETool Bot gentoo-dev

2021-07-06 03:41:58 UTC

This issue was resolved and addressed in
 GLSA 202107-07 at https://security.gentoo.org/glsa/202107-07
by GLSA coordinator John Helmert III (ajak).