Homepage
About Snyk

CVE-2021-43396 Affecting glibc package, versions <2.31-13+deb11u3

0.0
high

Snyk CVSS

    Attack Complexity Low
    Integrity High

    Threat Intelligence

    EPSS 0.56% (78th percentile)
Expand this section
NVD
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN11-GLIBC-1911968
  • published 5 Nov 2021
  • disclosed 4 Nov 2021
Report a new vulnerability Found a mistake?

Introduced: 4 Nov 2021

CVE-2021-43396 Open this link in a new tab

How to fix?

Upgrade Debian:11 glibc to version 2.31-13+deb11u3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.