The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2886-1 advisory.

  - res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL     pointer dereference and process crash). (CVE-2015-5180)

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-     based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with     a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the mention of Fixed for glibc 2.33 in the 26649 reference.
    (CVE-2020-29573)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5310-1 advisory.

    Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly     handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to     hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2021-3326)

    Jason Royes and Samuel Dytrych discovered that the GNU C Library incorrectly handled signed comparisons on     ARMv7 targets. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS. (CVE-2020-6096)

    It was discovered that the GNU C Library nscd daemon incorrectly handled certain netgroup lookups. An     attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of     service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-27645)

    It was discovered that the GNU C Library wordexp function incorrectly handled certain patterns. An     attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or     possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2021-35942)

    It was discovered that the GNU C Library realpath function incorrectly handled return values. An attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 21.10.
    (CVE-2021-3998)

    It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could     use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2021-3999)

    It was discovered that the GNU C Library sunrpc module incorrectly handled buffer lengths. An attacker     could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service.
    (CVE-2022-23218, CVE-2022-23219)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for glibc fixes the following issues :

CVE-2020-27618: Accept redundant shift sequences in IBM1364 (bsc#1178386)

CVE-2020-29562: Fix incorrect UCS4 inner loop bounds (bsc#1179694)

CVE-2020-29573: Harden printf against non-normal long double values (bsc#1179721)

Check vector support in memmove ifunc-selector (bsc#1184034)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the glibc package has been released.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An exploitable signed comparison vulnerability exists     in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that     utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed     comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could     lead to undefined behavior such as writing to     out-of-bounds memory and potentially remote code     execution. Furthermore, this memcpy() implementation     allows for program execution to continue in scenarios     where a segmentation fault or crash should have     occurred. The dangers occur in that subsequent     execution and iterations of this code will be executed     with this corrupted data.(CVE-2020-6096)

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - A flaw was found in glibc. When processing input in the     EUC-KR encoding, an invalid input sequence could cause     glibc to read beyond the end of a buffer, resulting in     a segmentation fault. The highest threat from this     vulnerability is to system     availability.(CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.32 and earlier, when processing invalid input     sequences in the ISO-2022-JP-3 encoding, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2021-3326)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in glibc. If an attacker provides the     iconv function with invalid multi-byte input sequences     in IBM1364, IBM1371, IBM1388, IBM1390, IBM1399     encodings, it fails to advance the input state, which     could lead to an infinite loop in applications,     resulting in a denial of service.(CVE-2020-27618)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - The iconv feature in the GNU C Library (aka glibc or     libc6) through 2.32, when processing invalid multi-byte     input sequences in the EUC-KR encoding, may have a     buffer over-read.(CVE-2019-25013)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

  - Fix buffer overrun in EUC-KR conversion module     (CVE-2019-25013, bsc#1182117, BZ #24973)

  - x86: Harden printf against non-normal long double values     (CVE-2020-29573, bsc#1179721, BZ #26649)

  - gconv: Fix assertion failure in ISO-2022-JP-3 module     (CVE-2021-3326, bsc#1181505, BZ #27256)

  - iconv: Accept redundant shift sequences in IBM1364     (CVE-2020-27618, bsc#1178386, BZ #26224)

  - iconv: Fix incorrect UCS4 inner loop bounds     (CVE-2020-29562, bsc#1179694, BZ #26923)

  - Fix parsing of /sys/devices/system/cpu/online     (bsc#1180038, BZ #25859)

This update was imported from the SUSE:SLE-15:Update update project.

This update for glibc fixes the following issues :

Fix buffer overrun in EUC-KR conversion module (CVE-2019-25013, bsc#1182117, BZ #24973)

x86: Harden printf against non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)

gconv: Fix assertion failure in ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)

iconv: Accept redundant shift sequences in IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)

iconv: Fix incorrect UCS4 inner loop bounds (CVE-2020-29562, bsc#1179694, BZ #26923)

Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of glibc installed on the remote host is prior to 2.26-41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1605 advisory.

    The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

    A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could     cause glibc to read beyond the end of a buffer, resulting in a segmentation fault. The highest threat from     this vulnerability is to system availability. (CVE-2019-25013)

    A denial of service flaw was found in the way glibc's iconv function handled UCS4 text containing an     irreversible character. This flaw causes an application compiled with glibc and using the vulnerable     function to terminate with an assertion, resulting in a denial of service. The highest threat from this     vulnerability is to system availability. (CVE-2020-29562)

    A signed comparison vulnerability was found in GNU libc in the ARMv7 implementation of memcpy(). The flaw     affects the third argument to memcpy() that specifies the number of bytes to copy. An underflow on the     third argument could lead to undefined behavior such as out-of-bounds memory write and potentially remote     code execution. (CVE-2020-6096)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

  - The iconv feature in the GNU C Library (aka glibc or     libc6) through 2.32, when processing invalid multi-byte     input sequences in the EUC-KR encoding, may have a     buffer over-read.(CVE-2019-25013)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202101-20 (glibc: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in glibc. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-6e581c051a advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-     of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows     for program execution to continue in scenarios where a segmentation fault or crash should have occurred.
    The dangers occur in that subsequent execution and iterations of this code will be executed with this     corrupted data. (CVE-2020-6096)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2020-29562)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
164426	SUSE SLES12 Security Update : glibc (SUSE-SU-2022:2886-1)	Nessus	SuSE Local Security Checks	high
158502	Ubuntu 18.04 LTS / 20.04 LTS : GNU C Library vulnerabilities (USN-5310-1)	Nessus	Ubuntu Local Security Checks	critical
148524	SUSE SLES12 Security Update : glibc (SUSE-SU-2021:1165-1)	Nessus	SuSE Local Security Checks	high
148029	Photon OS 4.0: Glibc PHSA-2021-4.0-0005	Nessus	PhotonOS Local Security Checks	high
147681	EulerOS Virtualization 2.9.0 : glibc (EulerOS-SA-2021-1643)	Nessus	Huawei Local Security Checks	high
147594	EulerOS Virtualization 2.9.1 : glibc (EulerOS-SA-2021-1600)	Nessus	Huawei Local Security Checks	high
147455	EulerOS Virtualization for ARM 64 3.0.2.0 : glibc (EulerOS-SA-2021-1382)	Nessus	Huawei Local Security Checks	high
147065	EulerOS Virtualization for ARM 64 3.0.6.0 : glibc (EulerOS-SA-2021-1537)	Nessus	Huawei Local Security Checks	high
146916	openSUSE Security Update : glibc (openSUSE-2021-358)	Nessus	SuSE Local Security Checks	high
146903	SUSE SLED15 / SLES15 Security Update : glibc (SUSE-SU-2021:0653-1)	Nessus	SuSE Local Security Checks	high
146627	Amazon Linux 2 : glibc (ALAS-2021-1605)	Nessus	Amazon Linux Local Security Checks	high
145715	EulerOS 2.0 SP8 : glibc (EulerOS-SA-2021-1142)	Nessus	Huawei Local Security Checks	high
145333	GLSA-202101-20 : glibc: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
145196	Fedora 32 : glibc (2021-6e581c051a)	Nessus	Fedora Local Security Checks	high
144695	EulerOS 2.0 SP9 : glibc (EulerOS-SA-2021-1024)	Nessus	Huawei Local Security Checks	high
144685	EulerOS 2.0 SP9 : glibc (EulerOS-SA-2021-1005)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2020-29562

medium

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high