Every CVE Search/ Get API key

CVE-2021-43396

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force...

7.5 HighFix availableDisputed

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

3.29%Up 2.8 points since Nov 5, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

Record
CVE-2021-43396
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Updated
2026-11-02
CVE List No score

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

Record
CVE-2021-43396
Updated
2026-11-02
EUVDEUVD-2021-30331 No score

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

Record
EUVD-2021-30331
Updated
2026-11-02
GitHub AdvisoriesGHSA-73g2-m4v3-6c2h 7.5

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force...

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases.

Record
GHSA-73g2-m4v3-6c2h
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVAZL-6443 7.5

CVE-2021-43396 affecting package glibc for versions less than 2.35-1

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

Record
AZL-6443
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSV 7.5

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

Record
CVE-2021-43396
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2021-43396 7.5

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

Record
DEBIAN-CVE-2021-43396
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVOESA-2021-1438 7.5

glibc security update

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases.(CVE-2021-43396)

Record
OESA-2021-1438
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVCLSA-2021-1636389414 No score

Fix CVE(s): CVE-2021-3326, CVE-2021-43396

  • SECURITY UPDATE: assertion failure in ISO-2022-JP-3 module
    • debian/patches/any/CVE-2021-3326.patch: enqueue a second wide character which cannot be written immediately in the state variable.
    • CVE-2021-3326
  • SECURITY UPDATE: emission of a spurious '\0' character on state reset
    • debian/patches/any/CVE-2021-3326.patch: check actual stored character in state reset code.
    • CVE-2021-43396
Record
CLSA-2021-1636389414
Updated
2026-11-02
OSVCLSA-2021-1636389447 No score

Fixed CVEs in glibc: CVE-2021-43396, CVE-2021-3326

  • CVE-2021-3326: avoid denial of service due to a failed assertion
  • CVE-2021-43396: check actual stored character in state reset code
Record
CLSA-2021-1636389447
Updated
2026-11-02
OSVCLSA-2021-1637583639 No score

Fix of CVE: CVE-2021-3326, CVE-2021-43396

  • CVE-2021-3326: avoid denial of service due to a failed assertion
  • CVE-2021-43396: check actual stored character in state reset code
Record
CLSA-2021-1637583639
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glibc
Azure Linux:2
 before 2.35-1
2.35-1
glibc-doc
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
glibc-source
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
libc-bin
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
libc-dev-bin
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
libc6
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
libc6-dev
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
libc6-dev-i386
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
libc6-dev-x32
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
libc6-i386
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
Show 25 moreShow less
Affected packages
PackageAffectedFixed
libc6-pic
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
libc6-x32
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
locales
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
locales-all
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
multiarch-support
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
nscd
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 2.23-0ubuntu11.5
2.23-0ubuntu11.5
glibc
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc-common
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc-devel
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc-headers
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc-static
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc-utils
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
nscd
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc-common
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc-devel
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc-headers
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc-static
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc-utils
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
nscd
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 2.12-2.215.el6.cloudlinux.els
2.12-2.215.el6.cloudlinux.els
glibc
Debian:12
 before 2.32-5
2.32-5
glibc
Debian:13
 before 2.32-5
2.32-5
glibc
Debian:14
 before 2.32-5
2.32-5
glibc
openEuler:20.03-LTS-SP1
 before 2.28-79.oe1
2.28-79.oe1
glibc
openEuler:20.03-LTS-SP2
 before 2.28-79.oe1
2.28-79.oe1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-43396 is a high vulnerability (CVSS 7.5) in Gnu Glibc, published November 4, 2021. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 3.29%, the 88th percentile. Fixed in glibc 2.35-1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open