Arch Linux Security Advisory ASA-202102-17 ========================================== Severity: Low Date : 2021-02-07 CVE-ID : CVE-2019-25013 CVE-2020-27618 CVE-2020-29562 CVE-2021-3326 Package : glibc Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1320 Summary ======= The package glibc before version 2.33-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.33-1. # pacman -Syu "glibc>=2.33-1" The problems have been fixed upstream in version 2.33. Workaround ========== None. Description =========== - CVE-2019-25013 (denial of service) The iconv feature in glibc up to version 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. The issue is fixed in glibc version 2.33. - CVE-2020-27618 (denial of service) A flaw was found in glibc up to version 2.32. If an attacker provides the iconv function with invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, IBM1399 encodings, it fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service. The issue is fixed in glibc version 2.33. - CVE-2020-29562 (denial of service) The iconv function in glibc version 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. The issue is fixed in glibc version 2.33. - CVE-2021-3326 (denial of service) The iconv function in glibc version 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. The issue is fixed in glibc version 2.33. Impact ====== A local attacker might cause a crash via specially crafted input. References ========== https://sourceware.org/pipermail/libc-alpha/2021-February/122207.html https://sourceware.org/bugzilla/show_bug.cgi?id=24973 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ee7a3144c992280818100... https://bugzilla.redhat.com/show_bug.cgi?id=1893708 https://sourceware.org/bugzilla/show_bug.cgi?id=26224 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=9a99c682144bdbd40792e... https://sourceware.org/bugzilla/show_bug.cgi?id=26923 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=228edd356f03bf62dcf2b... https://www.openwall.com/lists/oss-security/2021/01/27/3 https://sourceware.org/bugzilla/show_bug.cgi?id=27256 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=7d88c6142c6efc160c0ee... https://security.archlinux.org/CVE-2019-25013 https://security.archlinux.org/CVE-2020-27618 https://security.archlinux.org/CVE-2020-29562 https://security.archlinux.org/CVE-2021-3326