In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.
** EN DISPUTA ** En el archivo iconvdata/iso-2022-jp-3.c de la Biblioteca C de GNU (también conocida como glibc) 2.34, los atacantes remotos pueden forzar a iconv() a emitir un carácter espurio '\0' a través de datos ISO-2022-JP-3 manipulados que van acompañados de un reinicio de estado interno. Esto puede afectar a la integridad de los datos en ciertos casos de uso de iconv(). NOTA: el proveedor afirma que "el fallo no puede ser invocado a través de la entrada del usuario y requiere que iconv sea invocado con un inbuf NULL, lo que debería requerir un fallo de aplicación separado para hacerlo involuntariamente. Por lo tanto, el fallo no tiene impacto en la seguridad".
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | HIGH |
| Availability Impact | NONE |
AV:N/AC:L/Au:N/C:N/I:P/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| gnu | glibc | 2.34 | <built-in method update of dict object at 0x7fd340b9fb80> | Application |
| oracle | communications_cloud_native_core_binding_support_function | 22.1.3 | <built-in method update of dict object at 0x7fd38676db40> | Application |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 22.1.0 | <built-in method update of dict object at 0x7fd340a50380> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 22.1.2 | <built-in method update of dict object at 0x7fd2dbc18980> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 22.2.0 | <built-in method update of dict object at 0x7fd38676d700> | Application |
| oracle | communications_cloud_native_core_security_edge_protection_proxy | 22.1.1 | <built-in method update of dict object at 0x7fd34082cb80> | Application |
| oracle | communications_cloud_native_core_unified_data_repository | 22.2.0 | <built-in method update of dict object at 0x7fd369e80c80> | Application |
| oracle | enterprise_operations_monitor | 4.3 | <built-in method update of dict object at 0x7fd369e80e40> | Application |
| oracle | enterprise_operations_monitor | 4.4 | <built-in method update of dict object at 0x7fd369e81300> | Application |
| oracle | enterprise_operations_monitor | 5.0 | <built-in method update of dict object at 0x7fd38676ca00> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:gnu:glibc:2.34:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.2.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_operations_monitor:4.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_operations_monitor:4.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_operations_monitor:5.0:*:*:*:*:*:*:* |