The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2886-1 advisory.

  - res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL     pointer dereference and process crash). (CVE-2015-5180)

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-     based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with     a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the mention of Fixed for glibc 2.33 in the 26649 reference.
    (CVE-2020-29573)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 21.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5310-1 advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-     of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows     for program execution to continue in scenarios where a segmentation fault or crash should have occurred.
    The dangers occur in that subsequent execution and iterations of this code will be executed with this     corrupted data. (CVE-2020-6096)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2020-29562)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

  - The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when     processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in     degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
    (CVE-2021-27645)

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for glibc fixes the following issues :

CVE-2020-27618: Accept redundant shift sequences in IBM1364 (bsc#1178386)

CVE-2020-29562: Fix incorrect UCS4 inner loop bounds (bsc#1179694)

CVE-2020-29573: Harden printf against non-normal long double values (bsc#1179721)

Check vector support in memmove ifunc-selector (bsc#1184034)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the glibc package has been released.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An exploitable signed comparison vulnerability exists     in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that     utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed     comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could     lead to undefined behavior such as writing to     out-of-bounds memory and potentially remote code     execution. Furthermore, this memcpy() implementation     allows for program execution to continue in scenarios     where a segmentation fault or crash should have     occurred. The dangers occur in that subsequent     execution and iterations of this code will be executed     with this corrupted data.(CVE-2020-6096)

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - A flaw was found in glibc. When processing input in the     EUC-KR encoding, an invalid input sequence could cause     glibc to read beyond the end of a buffer, resulting in     a segmentation fault. The highest threat from this     vulnerability is to system     availability.(CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.32 and earlier, when processing invalid input     sequences in the ISO-2022-JP-3 encoding, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2021-3326)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in glibc. If an attacker provides the     iconv function with invalid multi-byte input sequences     in IBM1364, IBM1371, IBM1388, IBM1390, IBM1399     encodings, it fails to advance the input state, which     could lead to an infinite loop in applications,     resulting in a denial of service.(CVE-2020-27618)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - The iconv feature in the GNU C Library (aka glibc or     libc6) through 2.32, when processing invalid multi-byte     input sequences in the EUC-KR encoding, may have a     buffer over-read.(CVE-2019-25013)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

  - Fix buffer overrun in EUC-KR conversion module     (CVE-2019-25013, bsc#1182117, BZ #24973)

  - x86: Harden printf against non-normal long double values     (CVE-2020-29573, bsc#1179721, BZ #26649)

  - gconv: Fix assertion failure in ISO-2022-JP-3 module     (CVE-2021-3326, bsc#1181505, BZ #27256)

  - iconv: Accept redundant shift sequences in IBM1364     (CVE-2020-27618, bsc#1178386, BZ #26224)

  - iconv: Fix incorrect UCS4 inner loop bounds     (CVE-2020-29562, bsc#1179694, BZ #26923)

  - Fix parsing of /sys/devices/system/cpu/online     (bsc#1180038, BZ #25859)

This update was imported from the SUSE:SLE-15:Update update project.

This update for glibc fixes the following issues :

Fix buffer overrun in EUC-KR conversion module (CVE-2019-25013, bsc#1182117, BZ #24973)

x86: Harden printf against non-normal long double values (CVE-2020-29573, bsc#1179721, BZ #26649)

gconv: Fix assertion failure in ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)

iconv: Accept redundant shift sequences in IBM1364 (CVE-2020-27618, bsc#1178386, BZ #26224)

iconv: Fix incorrect UCS4 inner loop bounds (CVE-2020-29562, bsc#1179694, BZ #26923)

Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of glibc installed on the remote host is prior to 2.26-41. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1605 advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2020-29562)

  - An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-     of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows     for program execution to continue in scenarios where a segmentation fault or crash should have occurred.
    The dangers occur in that subsequent execution and iterations of this code will be executed with this     corrupted data. (CVE-2020-6096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

  - The iconv feature in the GNU C Library (aka glibc or     libc6) through 2.32, when processing invalid multi-byte     input sequences in the EUC-KR encoding, may have a     buffer over-read.(CVE-2019-25013)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202101-20 (glibc: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in glibc. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-6e581c051a advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc     2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative     value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the     'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-     of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows     for program execution to continue in scenarios where a segmentation fault or crash should have occurred.
    The dangers occur in that subsequent execution and iterations of this code will be executed with this     corrupted data. (CVE-2020-6096)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2020-29562)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
164426	SUSE SLES12 Security Update : glibc (SUSE-SU-2022:2886-1)	Nessus	SuSE Local Security Checks	high
158502	Ubuntu 18.04 LTS / 20.04 LTS : GNU C Library vulnerabilities (USN-5310-1)	Nessus	Ubuntu Local Security Checks	critical
148524	SUSE SLES12 Security Update : glibc (SUSE-SU-2021:1165-1)	Nessus	SuSE Local Security Checks	high
148029	Photon OS 4.0: Glibc PHSA-2021-4.0-0005	Nessus	PhotonOS Local Security Checks	high
147681	EulerOS Virtualization 2.9.0 : glibc (EulerOS-SA-2021-1643)	Nessus	Huawei Local Security Checks	high
147594	EulerOS Virtualization 2.9.1 : glibc (EulerOS-SA-2021-1600)	Nessus	Huawei Local Security Checks	high
147455	EulerOS Virtualization for ARM 64 3.0.2.0 : glibc (EulerOS-SA-2021-1382)	Nessus	Huawei Local Security Checks	high
147065	EulerOS Virtualization for ARM 64 3.0.6.0 : glibc (EulerOS-SA-2021-1537)	Nessus	Huawei Local Security Checks	high
146916	openSUSE Security Update : glibc (openSUSE-2021-358)	Nessus	SuSE Local Security Checks	high
146903	SUSE SLED15 / SLES15 Security Update : glibc (SUSE-SU-2021:0653-1)	Nessus	SuSE Local Security Checks	high
146627	Amazon Linux 2 : glibc (ALAS-2021-1605)	Nessus	Amazon Linux Local Security Checks	high
145715	EulerOS 2.0 SP8 : glibc (EulerOS-SA-2021-1142)	Nessus	Huawei Local Security Checks	high
145333	GLSA-202101-20 : glibc: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
145196	Fedora 32 : glibc (2021-6e581c051a)	Nessus	Fedora Local Security Checks	high
144695	EulerOS 2.0 SP9 : glibc (EulerOS-SA-2021-1024)	Nessus	Huawei Local Security Checks	high
144685	EulerOS 2.0 SP9 : glibc (EulerOS-SA-2021-1005)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2020-29562

medium

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high