Log in Start free

Vulnerability · Published Nov 4, 2021 · Assigned by mitre

CVE-2021-43396

High 7.5

In plain English

A high-severity security flaw in the glibc package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)3.3%top 11.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12glibc2.32-5DEBIAN-CVE-2021-43396
Debian:13glibc2.32-5DEBIAN-CVE-2021-43396
Debian:14glibc2.32-5DEBIAN-CVE-2021-43396

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References