CVE-2024-2961

2024-04-1718:15:15

Debian Security Bug Tracker

security-tracker.debian.org

buffer overflow

iconv function

gnu c library

iso-2022-cn-ext

security vulnerability

unix

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

AI Score

7.4

Confidence

Low

EPSS

0.001

Percentile

17.1%

JSON

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

OSVersionArchitecturePackageVersionFilename
Debian12allglibc< 2.36-9+deb12u6glibc_2.36-9+deb12u6_all.deb
Debian11allglibc< 2.31-13+deb11u9glibc_2.31-13+deb11u9_all.deb
Debian999allglibc< 2.37-18glibc_2.37-18_all.deb
Debian13allglibc< 2.37-18glibc_2.37-18_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	glibc	< 2.36-9+deb12u6	glibc_2.36-9+deb12u6_all.deb
Debian	11	all	glibc	< 2.31-13+deb11u9	glibc_2.31-13+deb11u9_all.deb
Debian	999	all	glibc	< 2.37-18	glibc_2.37-18_all.deb
Debian	13	all	glibc	< 2.37-18	glibc_2.37-18_all.deb