Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 822015 (CVE-2021-43396) - sys-libs/glibc: remote corruption of iconv() output (CVE-2021-43396)
Summary: sys-libs/glibc: remote corruption of iconv() output (CVE-2021-43396)
Status: RESOLVED INVALID
Alias: CVE-2021-43396
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://sourceware.org/bugzilla/show_...
Whiteboard: A4 [ebuild]
Keywords:
Depends on:
Blocks:
 
Reported: 2021-11-05 21:26 UTC by John Helmert III
Modified: 2022-04-12 10:01 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-11-05 21:26:01 UTC 
CVE-2021-43396:

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases.

Appears to be unreleased.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-11-05 21:33:33 UTC 
2.34 backport at https://sourceware.org/git/?p=glibc.git;a=commit;h=f411207a833d0c49578ebe7062aee3660813ed5f

Doesn't seme to have been backported to 2.33 so I suppose not applicable.

Note that we probably want the latest 2.34 patches in that branch anyway.