CVE-2019-25013

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.\r\n\r\n Security Fix(es):\r\n\r\n The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.(CVE-2019-25013)\r\n\r\n

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding (CVE-2019-25013)

• glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read (CVE-2019-9169)

• glibc: assertion failure in ISO-2022-JP-3 gconv module related to combining characters (CVE-2021-3326)

• glibc: iconv program can hang when invoked with the -c option (CVE-2016-10228)

• glibc: iconv when processing invalid multi-byte input sequences fails to advance the input state, which could result in an infinite loop (CVE-2020-27618)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR encoding (CVE-2019-25013)

• glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read (CVE-2019-9169)

• glibc: assertion failure in ISO-2022-JP-3 gconv module related to combining characters (CVE-2021-3326)

• glibc: iconv program can hang when invoked with the -c option (CVE-2016-10228)

• glibc: iconv when processing invalid multi-byte input sequences fails to advance the input state, which could result in an infinite loop (CVE-2020-27618)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• SECURITY UPDATE: buffer overrun in EUC-KR conversion module
  • debian/patches/any/CVE-2019-25013: skip two bytes when told to skip over the unknown designation, potentially running over the buffer end
  • CVE-2019-25013
• SECURITY UPDATE: hang in the iconv program
  • debian/patches/any/CVE-2020-27618: adjust the converter to accept redundant shift sequences in IBM1364, IBM1371, IBM1388, IBM1390 and IBM1399 character sets
  • CVE-2020-27618

Security fixes:

• fix buffer overrun in EUC-KR conversion module [bz #2497] (CVE-2019-25013)
• arm: CVE-2020-6096: Fix multiarch memcpy for negative length [BZ #25620]
• arm: CVE-2020-6096: fix memcpy and memmove for negative length [BZ #25620]
• iconv: Fix incorrect UCS4 inner loop bounds [BZ #26923] (CVE-2020-29562) other upstream fixes:
• libio: Disable vtable validation for pre-2.1 interposed handles [BZ #25203]
• string.h: Define __CORRECT_ISO_CPP_STRING_H_PROTO for Clang [BZ #25232]
• misc/test-errno-linux: Handle EINVAL from quotactl
• nss_compat: internal_end*ent may clobber errno, hiding ERANGE [BZ #25976]
• Fix avx2 strncmp offset compare condition check [BZ #25933]
• AArch64: Align ENTRY to a cacheline
• AArch64: Add optimized Q-register memcpy
• AArch64: Improve backwards memmove performance
• AArch64: Rename IS_ARES to IS_NEOVERSE_N1
• AArch64: Increase small and medium cases for __memcpy_generic
• AArch64: Improve integer memcpy
• AArch64: Use __memcpy_simd on Neoverse N2/V1
• AArch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
• AArch64: fix stack missing after sp is updated
• x86-64: Avoid rep movsb with short distance [BZ #27130]
• x86: Assume --enable-cet if GCC defaults to CET [BZ #25225]
• x86: Check IFUNC definition in unrelocated executable [BZ #20019]
• x86: Set header.feature_1 in TCB for always-on CET [BZ #27177]
• Fix parsing of /sys/devices/system/cpu/online [BZ #25859]
• Use O_CLOEXEC in sysconf [BZ #26791]

This update for glibc fixes the following issues:

• Fix buffer overrun in EUC-KR conversion module (CVE-2019-25013, bsc#1182117, BZ #24973)
• x86: Harden printf against non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
• gconv: Fix assertion failure in ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)
• iconv: Accept redundant shift sequences in IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
• iconv: Fix incorrect UCS4 inner loop bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
• Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the glibc-2.34-1.2 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

• Fix buffer overrun in EUC-KR conversion module (CVE-2019-25013, bsc#1182117, BZ #24973)
• gconv: Fix assertion failure in ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)
• Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)
• powerpc: Add support for POWER10 (bsc#1181365)

This update for glibc fixes the following issues:

• Fix buffer overrun in EUC-KR conversion module (CVE-2019-25013, bsc#1182117, BZ #24973)
• x86: Harden printf against non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)
• gconv: Fix assertion failure in ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)
• iconv: Accept redundant shift sequences in IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)
• iconv: Fix incorrect UCS4 inner loop bounds (CVE-2020-29562, bsc#1179694, BZ #26923)
• Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)

This update for glibc fixes the following issues:

Security issues fixed:

• CVE-2015-5180: Fix crash with internal QTYPE in resolv (bsc#941234, BZ #18784)

• CVE-2016-10228: Rewrite iconv option parsing (bsc#1027496, BZ #19519)

• CVE-2019-25013: Fix buffer overrun in EUC-KR conversion module (bsc#1182117, BZ #24973)

• CVE-2020-27618: Accept redundant shift sequences in IBM1364 iconv module (bsc#1178386, BZ #26224)

• CVE-2020-29562: Fix incorrect UCS4 inner loop bounds in iconv (bsc#1179694, BZ #26923)

• CVE-2020-29573: Hardened printf against non-normal long double values (bsc#1179721, BZ #26649)

• CVE-2021-3326: Fix assertion failure in ISO-2022-JP-3 gconv module (bsc#1181505, BZ #27256)

• Recognize ppc64p7 arch to build for power7

This update for glibc fixes the following issues:

Security issues fixed:

• CVE-2020-29573: x86: printf was hardened against non-normal long double values (bsc#1179721, BZ #26649)

• CVE-2021-3326: Fix assertion failure in gconv ISO-2022-JP-3 module (bsc#1181505, BZ #27256)

• CVE-2019-25013: Fix buffer overrun in EUC-KR conversion module (bsc#1182117, BZ #24973)

• CVE-2020-27618: Accept redundant shift sequences in IBM1364 iconv (bsc#1178386, BZ #26224)

• CVE-2020-29562: Fix incorrect UCS4 inner loop bounds in iconv (bsc#1179694, BZ #26923)

• Schedule nscd cache pruning more accurately from re-added values (bsc#1018158)

Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2021-3326)

Jason Royes and Samuel Dytrych discovered that the GNU C Library incorrectly handled signed comparisons on ARMv7 targets. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-6096)

It was discovered that the GNU C Library nscd daemon incorrectly handled certain netgroup lookups. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-27645)

It was discovered that the GNU C Library wordexp function incorrectly handled certain patterns. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-35942)

It was discovered that the GNU C Library realpath function incorrectly handled return values. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 21.10. (CVE-2021-3998)

It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3999)

It was discovered that the GNU C Library sunrpc module incorrectly handled buffer lengths. An attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service. (CVE-2022-23218, CVE-2022-23219)

Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to hang or crash, resulting in a denial of service. (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618)

It was discovered that the GNU C Library did not properly handled DNS responses when ENDS0 is enabled. An attacker could possibly use this issue to cause fragmentation-based attacks. (CVE-2017-12132)