[manjaro-security] [ASA-202102-16] lib32-glibc: denial of service

[Remi Gacogne via arch-security]

Arch Linux Security Advisory ASA-202102-16
==========================================

Severity: Low
Date    : 2021-02-07
CVE-ID  : CVE-2019-25013 CVE-2020-27618 CVE-2020-29562 CVE-2021-3326
Package : lib32-glibc
Type    : denial of service
Remote  : No
Link    : https://security.archlinux.org/AVG-1320

Summary
=======

The package lib32-glibc before version 2.33-1 is vulnerable to denial
of service.

Resolution
==========

Upgrade to 2.33-1.

# pacman -Syu "lib32-glibc>=2.33-1"

The problems have been fixed upstream in version 2.33.

Workaround
==========

None.

Description
===========

- CVE-2019-25013 (denial of service)

The iconv feature in glibc up to version 2.32, when processing invalid
multi-byte input sequences in the EUC-KR encoding, may have a buffer
over-read. The issue is fixed in glibc version 2.33.

- CVE-2020-27618 (denial of service)

A flaw was found in glibc up to version 2.32. If an attacker provides
the iconv function with invalid multi-byte input sequences in IBM1364,
IBM1371, IBM1388, IBM1390, IBM1399 encodings, it fails to advance the
input state, which could lead to an infinite loop in applications,
resulting in a denial of service. The issue is fixed in glibc version
2.33.

- CVE-2020-29562 (denial of service)

The iconv function in glibc version 2.30 to 2.32, when converting UCS4
text containing an irreversible character, fails an assertion in the
code path and aborts the program, potentially resulting in a denial of
service. The issue is fixed in glibc version 2.33.

- CVE-2021-3326 (denial of service)

The iconv function in glibc version 2.32 and earlier, when processing
invalid input sequences in the ISO-2022-JP-3 encoding, fails an
assertion in the code path and aborts the program, potentially
resulting in a denial of service. The issue is fixed in glibc version
2.33.

Impact
======

A local attacker might cause a crash via specially crafted input.

References
==========

https://sourceware.org/pipermail/libc-alpha/2021-February/122207.html
https://sourceware.org/bugzilla/show_bug.cgi?id=24973
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ee7a3144c9922808181009b7b3e50e852fb4999b
https://bugzilla.redhat.com/show_bug.cgi?id=1893708
https://sourceware.org/bugzilla/show_bug.cgi?id=26224
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=9a99c682144bdbd40792ebf822fe9264e0376fb5
https://sourceware.org/bugzilla/show_bug.cgi?id=26923
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=228edd356f03bf62dcf2b1335f25d43c602ee68d
https://www.openwall.com/lists/oss-security/2021/01/27/3
https://sourceware.org/bugzilla/show_bug.cgi?id=27256
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=7d88c6142c6efc160c0ee5e4f85cde382c072888
https://security.archlinux.org/CVE-2019-25013
https://security.archlinux.org/CVE-2020-27618
https://security.archlinux.org/CVE-2020-29562
https://security.archlinux.org/CVE-2021-3326

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://lists.manjaro.org/pipermail/manjaro-security/attachments/20210212/f3d38dcc/attachment.sig>