CVE-2024-2961

2024-04-1718:15:15

Debian Security Bug Tracker

security-tracker.debian.org

buffer overflow

iconv function

gnu c library

iso-2022-cn-ext

security vulnerability

unix

7.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

12.7%

JSON

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

OSVersionArchitecturePackageVersionFilename
Debian12allglibc< 2.36-9+deb12u6glibc_2.36-9+deb12u6_all.deb
Debian11allglibc< 2.31-13+deb11u9glibc_2.31-13+deb11u9_all.deb
Debian10allglibc< 2.28-10+deb10u3glibc_2.28-10+deb10u3_all.deb
Debian999allglibc< 2.37-18glibc_2.37-18_all.deb
Debian13allglibc< 2.37-18glibc_2.37-18_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	glibc	< 2.36-9+deb12u6	glibc_2.36-9+deb12u6_all.deb
Debian	11	all	glibc	< 2.31-13+deb11u9	glibc_2.31-13+deb11u9_all.deb
Debian	10	all	glibc	< 2.28-10+deb10u3	glibc_2.28-10+deb10u3_all.deb
Debian	999	all	glibc	< 2.37-18	glibc_2.37-18_all.deb
Debian	13	all	glibc	< 2.37-18	glibc_2.37-18_all.deb