The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service. The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability.
This was fixed in version 2.32.Īn exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. Directory paths containing an initial tilde followed by a valid username were affected by this issue. The highest threat from this vulnerability is to system availability.Ī use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. 15 issues left for the package maintainer to handle:Īn out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC.
0 kommentar(er)
