Ubuntu.comUB:CVE-2021-43396CVE-2021-43396
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.007 Low
EPSS
Percentile
79.5%
DISPUTED In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka
glibc) 2.34, remote attackers can force iconv() to emit a spurious ‘\0’
character via crafted ISO-2022-JP-3 data that is accompanied by an internal
state reset. This may affect data integrity in certain iconv() use cases.
NOTE: the vendor states “the bug cannot be invoked through user input and
requires iconv to be invoked with a NULL inbuf, which ought to require a
separate application bug to do so unintentionally. Hence there’s no
security impact to the bug.”
Bugs
- <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998622>
- <https://sourceware.org/bugzilla/show_bug.cgi?id=28524>
- <https://sourceware.org/bugzilla/show_bug.cgi?id=28524#c4>
Notes
| Author | Note |
|---|---|
| mdeslaur | this was disputed as not being a security issue, marking as not-affected |
Related
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.007 Low
EPSS
Percentile
79.5%