Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Mageia 7: MGASA-2021-0150 Moderate: Glibc Denial Of Service Exploit

mageia
Calendar Grey March 21, 2021
Dist Mageia Esm H88
Revised glibc distributions tackle severe vulnerabilities that lead to service interruptions and possible application failures, improving overall security.
Updated glibc packages fix a security vulnerabilities: The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequ...

Summary

Updated glibc packages fix a security vulnerabilities:
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service (CVE-2020-27618).
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service (CVE-2021-3326).
The nameserver caching daemon (nscd), when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system (CVE-2021-27645).

References

- https://bugs.mageia.org/show_bug.cgi?id=28246

- https://www.cve.org/CVERecord?id=CVE-2020-27618

- https://www.cve.org/CVERecord?id=CVE-2021-3326

- https://www.cve.org/CVERecord?id=CVE-2021-27645

Resolution

SRPMS

- 7/core/glibc-2.29-22.mga7

Publication date: 21 Mar 2021
URL: https://advisories.mageia.org/MGASA-2021-0150.html
Type: security
CVE: CVE-2020-27618, CVE-2021-3326, CVE-2021-27645

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here