Homepage

Improper Input Validation The advisory has been revoked - it doesn't affect any version of package glibc-langpack-ja  (opens in a new tab)

Threat Intelligence

EPSS
3.29% (88th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-GLIBCLANGPACKJA-1912252
  • published6 Nov 2021
  • disclosed4 Nov 2021
Report a new vulnerability Found a mistake?

Introduced: 4 Nov 2021

CVE-2021-43396  (opens in a new tab)
CWE-20  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-langpack-ja package and not the glibc-langpack-ja package as distributed by RHEL.

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.