Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibcUpgrade glibc-headersUpgrade nscdUpgrade glibc-staticUpgrade glibc-commonUpgrade glibc-develUpgrade glibc-utils | Dec 1, 2016 | Aug 29, 2014 |
| Debian | — | Upgrade eglibcUpgrade glibc | Jul 30, 2024 | Aug 29, 2014 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Aug 29, 2014 |
| Oracle_linux | — | Upgrade glibcUpgrade glibc-headersUpgrade glibc-staticUpgrade nscdUpgrade glibc-develUpgrade glibc-commonUpgrade glibc-utils | Oct 16, 2024 | Aug 29, 2014 |
| Suse | — | Upgrade glibc-profile-32bitUpgrade glibc-32bitUpgrade pam-modulesUpgrade glibc-profileUpgrade glibcUpgrade pwdutilsUpgrade glibc-profile-x86Upgrade glibc-infoUpgrade libxcryptUpgrade glibc-extraUpgrade glibc-x86Upgrade glibc-locale-x86Upgrade glibc-develUpgrade glibc-locale-32bitUpgrade glibc-localeUpgrade nscdUpgrade glibc-devel-32bitUpgrade glibc-i18ndataUpgrade pwdutils-plugin-auditUpgrade glibc-utilsUpgrade glibc-devel-staticUpgrade libxcrypt-32bitUpgrade glibc-locale-baseUpgrade glibc-htmlUpgrade pam-modules-32bit | Dec 18, 2015 | Aug 29, 2014 |
| Ubuntu | — | Upgrade libc6 | Nov 8, 2024 | Aug 29, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub