Log in Start free

Vulnerability · Published Jan 27, 2021 · Assigned by mitre

CVE-2021-3326

High 7.5

In plain English

A high-severity security flaw in the glibc-benchtests package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.8%top 9.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8glibc-benchtests2.28-151.el8ALSA-2021:1585
AlmaLinux:8glibc-nss-devel2.28-151.el8ALSA-2021:1585
AlmaLinux:8glibc-static2.28-151.el8ALSA-2021:1585
AlmaLinux:8nss_hesiod2.28-151.el8ALSA-2021:1585
Debian:12glibc2.31-10DEBIAN-CVE-2021-3326
Debian:13glibc2.31-10DEBIAN-CVE-2021-3326
Debian:14glibc2.31-10DEBIAN-CVE-2021-3326
Rocky Linux:8glibc0:2.28-151.el8RLSA-2021:1585

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References