Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

glibc: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence

Related Vulnerabilities: CVE-2024-2961  

Source

Debian Bug report logs - #1069191
glibc: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence

version graph

Package: src:glibc; Maintainer for src:glibc is GNU Libc Maintainers <debian-glibc@lists.debian.org>;

Reported by: Salvatore Bonaccorso <carnil@debian.org>

Date: Wed, 17 Apr 2024 19:03:01 UTC

Severity: important

Tags: security, upstream

Found in versions glibc/2.36-9+deb12u4, glibc/2.36-9+deb12u5, glibc/2.31-13, glibc/2.37-17, glibc/2.31-13+deb11u8, glibc/2.37-15, glibc/2.36-9

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, GNU Libc Maintainers <debian-glibc@lists.debian.org>:
Bug#1069191; Package src:glibc. (Wed, 17 Apr 2024 19:03:03 GMT) (full text, mbox, link).

Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, GNU Libc Maintainers <debian-glibc@lists.debian.org>. (Wed, 17 Apr 2024 19:03:03 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: glibc: GLIBC-SA-2024-0004/CVE-2024-2961: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence
Date: Wed, 17 Apr 2024 20:58:50 +0200
Source: glibc
Version: 2.37-17
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 2.37-15
Control: found -1 2.36-9+deb12u5
Control: found -1 2.36-9+deb12u4
Control: found -1 2.36-9
Control: found -1 2.31-13+deb11u8
Control: found -1 2.31-13

Hi,

The following vulnerability was published for glibc.

CVE-2024-2961[0]:
| The iconv() function in the GNU C Library versions 2.39 and older
| may overflow the output buffer passed to it by up to 4 bytes when
| converting strings to the ISO-2022-CN-EXT character set, which may
| be used to crash an application or overwrite a neighbouring
| variable.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-2961
    https://www.cve.org/CVERecord?id=CVE-2024-2961
[1] https://www.openwall.com/lists/oss-security/2024/04/17/9

Regards,
Salvatore

Marked as found in versions glibc/2.37-15. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Wed, 17 Apr 2024 19:03:03 GMT) (full text, mbox, link).

Marked as found in versions glibc/2.36-9+deb12u5. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Wed, 17 Apr 2024 19:03:04 GMT) (full text, mbox, link).

Marked as found in versions glibc/2.36-9+deb12u4. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Wed, 17 Apr 2024 19:03:05 GMT) (full text, mbox, link).

Marked as found in versions glibc/2.36-9. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Wed, 17 Apr 2024 19:03:05 GMT) (full text, mbox, link).

Marked as found in versions glibc/2.31-13+deb11u8. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Wed, 17 Apr 2024 19:03:06 GMT) (full text, mbox, link).

Marked as found in versions glibc/2.31-13. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Wed, 17 Apr 2024 19:03:06 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Thu Apr 18 11:54:00 2024; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started