Stay Secure with the Latest Linux Advisories

security advisorydenial of servicesoftware upgrade

Arch Linux 2.33-1 Security Advisory: Glibc Denial Of Service

The package glibc before version 2.33-1 is vulnerable to denial of service. . Arch Linux Security Advisory ASA-202102-17 ========================================= Severity: Low Date : 2021-02-07 CVE-ID : CVE-2019-25013 CVE-2020-27618 CVE-2020-29562 CVE-2021-3326 Package : glibc Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1320 Summary ====== The package glibc before version 2.33-1 is vulnerable to denial of service. Resolution ========= Upgrade to 2.33-1. # pacman -Syu "glibc> =2.33-1" The problems have been fixed upstream in version 2.33. Workaround ========= None. Description ========== - CVE-2019-25013 (denial of service) The iconv feature in glibc up to version 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. The issue is fixed in glibc version 2.33. - CVE-2020-27618 (denial of service) A flaw was found in glibc up to version 2.32. If an attacker provides the iconv function with invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, IBM1399 encodings, it fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service. The issue is fixed in glibc version 2.33. - CVE-2020-29562 (denial of service) The iconv function in glibc version 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. The issue is fixed in glibc version 2.33. - CVE-2021-3326 (denial of service) The iconv function in glibc version 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. The issue is fixed in glibc version 2.33. Impact ===== A local attacker might cause a crash via specially craftedinput. References ========= https://sourceware.org/pipermail/libc-alpha/2021-February/122207.html https://sourceware.org/bugzilla/show_bug.cgi?id=24973 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ee7a3144c9922808181009b7b3e50e852fb4999b https://bugzilla.redhat.com/show_bug.cgi?id=1893708 https://sourceware.org/bugzilla/show_bug.cgi?id=26224 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=9a99c682144bdbd40792ebf822fe9264e0376fb5 https://sourceware.org/bugzilla/show_bug.cgi?id=26923 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=228edd356f03bf62dcf2b1335f25d43c602ee68d https://www.openwall.com/lists/oss-security/2021/01/27/3 https://sourceware.org/bugzilla/show_bug.cgi?id=27256 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=7d88c6142c6efc160c0ee5e4f85cde382c072888 https://security.archlinux.org/CVE-2019-25013 https://security.archlinux.org/CVE-2020-27618 https://security.archlinux.org/CVE-2020-29562 https://security.archlinux.org/CVE-2021-3326 . Address the minor glibc denial of service vulnerability present in Arch Linux by upgrading to version 2.33-1, which mitigates the risk associated with this issue.. glibc Denial Of Service, Arch Linux Security Advisory, Software Update. . Severity: Low. LinuxSecurity.com Team

Feb 12, 2021 •Low ArchLinux