CVE-2020-29562

The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

Security fixes:

• fix buffer overrun in EUC-KR conversion module [bz #2497] (CVE-2019-25013)
• arm: CVE-2020-6096: Fix multiarch memcpy for negative length [BZ #25620]
• arm: CVE-2020-6096: fix memcpy and memmove for negative length [BZ #25620]
• iconv: Fix incorrect UCS4 inner loop bounds [BZ #26923] (CVE-2020-29562) other upstream fixes:
• libio: Disable vtable validation for pre-2.1 interposed handles [BZ #25203]
• string.h: Define __CORRECT_ISO_CPP_STRING_H_PROTO for Clang [BZ #25232]
• misc/test-errno-linux: Handle EINVAL from quotactl
• nss_compat: internal_end*ent may clobber errno, hiding ERANGE [BZ #25976]
• Fix avx2 strncmp offset compare condition check [BZ #25933]
• AArch64: Align ENTRY to a cacheline
• AArch64: Add optimized Q-register memcpy
• AArch64: Improve backwards memmove performance
• AArch64: Rename IS_ARES to IS_NEOVERSE_N1
• AArch64: Increase small and medium cases for __memcpy_generic
• AArch64: Improve integer memcpy
• AArch64: Use __memcpy_simd on Neoverse N2/V1
• AArch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
• AArch64: fix stack missing after sp is updated
• x86-64: Avoid rep movsb with short distance [BZ #27130]
• x86: Assume --enable-cet if GCC defaults to CET [BZ #25225]
• x86: Check IFUNC definition in unrelocated executable [BZ #20019]
• x86: Set header.feature_1 in TCB for always-on CET [BZ #27177]
• Fix parsing of /sys/devices/system/cpu/online [BZ #25859]
• Use O_CLOEXEC in sysconf [BZ #26791]

This update for glibc fixes the following issues:

• Fix buffer overrun in EUC-KR conversion module (CVE-2019-25013, bsc#1182117, BZ #24973)
• x86: Harden printf against non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
• gconv: Fix assertion failure in ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)
• iconv: Accept redundant shift sequences in IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
• iconv: Fix incorrect UCS4 inner loop bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
• Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the glibc-2.34-1.2 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

• Fix buffer overrun in EUC-KR conversion module (CVE-2019-25013, bsc#1182117, BZ #24973)
• x86: Harden printf against non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
• gconv: Fix assertion failure in ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)
• iconv: Accept redundant shift sequences in IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
• iconv: Fix incorrect UCS4 inner loop bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
• Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)

This update for glibc fixes the following issues:

• CVE-2020-27618: Accept redundant shift sequences in IBM1364 (bsc#1178386)
• CVE-2020-29562: Fix incorrect UCS4 inner loop bounds (bsc#1179694)
• CVE-2020-29573: Harden printf against non-normal long double values (bsc#1179721)
• Check vector support in memmove ifunc-selector (bsc#1184034)

This update for glibc fixes the following issues:

Security issues fixed:

• CVE-2015-5180: Fix crash with internal QTYPE in resolv (bsc#941234, BZ #18784)

• CVE-2016-10228: Rewrite iconv option parsing (bsc#1027496, BZ #19519)

• CVE-2019-25013: Fix buffer overrun in EUC-KR conversion module (bsc#1182117, BZ #24973)

• CVE-2020-27618: Accept redundant shift sequences in IBM1364 iconv module (bsc#1178386, BZ #26224)

• CVE-2020-29562: Fix incorrect UCS4 inner loop bounds in iconv (bsc#1179694, BZ #26923)

• CVE-2020-29573: Hardened printf against non-normal long double values (bsc#1179721, BZ #26649)

• CVE-2021-3326: Fix assertion failure in ISO-2022-JP-3 gconv module (bsc#1181505, BZ #27256)

• Recognize ppc64p7 arch to build for power7

This update for glibc fixes the following issues:

Security issues fixed:

• CVE-2020-29573: x86: printf was hardened against non-normal long double values (bsc#1179721, BZ #26649)

• CVE-2021-3326: Fix assertion failure in gconv ISO-2022-JP-3 module (bsc#1181505, BZ #27256)

• CVE-2019-25013: Fix buffer overrun in EUC-KR conversion module (bsc#1182117, BZ #24973)

• CVE-2020-27618: Accept redundant shift sequences in IBM1364 iconv (bsc#1178386, BZ #26224)

• CVE-2020-29562: Fix incorrect UCS4 inner loop bounds in iconv (bsc#1179694, BZ #26923)

• Schedule nscd cache pruning more accurately from re-added values (bsc#1018158)

Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2021-3326)

Jason Royes and Samuel Dytrych discovered that the GNU C Library incorrectly handled signed comparisons on ARMv7 targets. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-6096)

It was discovered that the GNU C Library nscd daemon incorrectly handled certain netgroup lookups. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-27645)

It was discovered that the GNU C Library wordexp function incorrectly handled certain patterns. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-35942)

It was discovered that the GNU C Library realpath function incorrectly handled return values. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 21.10. (CVE-2021-3998)

It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3999)

It was discovered that the GNU C Library sunrpc module incorrectly handled buffer lengths. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. (CVE-2022-23218, CVE-2022-23219)