GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibcUpgrade glibc-staticUpgrade glibc-develUpgrade glibc-utilsUpgrade glibc-headersUpgrade glibc-commonUpgrade nscd | Dec 1, 2016 | Dec 5, 2014 |
| Debian | — | Upgrade eglibcUpgrade glibc | Jul 30, 2024 | Dec 5, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 16, 2015 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Dec 5, 2014 |
| Oracle_linux | — | Upgrade glibc-develUpgrade nscdUpgrade glibcUpgrade glibc-headersUpgrade glibc-staticUpgrade glibc-utilsUpgrade glibc-common | Oct 16, 2024 | Dec 5, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 28, 2014 |
| Suse | — | Upgrade glibc-profile-x86Upgrade glibc-profileUpgrade glibc-infoUpgrade pam-modulesUpgrade libxcryptUpgrade glibc-32bitUpgrade glibc-x86Upgrade glibc-profile-32bitUpgrade glibcUpgrade glibc-locale-32bitUpgrade glibc-extraUpgrade nscdUpgrade pwdutilsUpgrade pwdutils-plugin-auditUpgrade pam-modules-32bitUpgrade libxcrypt-32bitUpgrade glibc-i18ndataUpgrade glibc-devel-32bitUpgrade glibc-locale-baseUpgrade glibc-localeUpgrade glibc-devel-staticUpgrade glibc-develUpgrade glibc-utilsUpgrade glibc-locale-x86Upgrade glibc-html | Dec 18, 2015 | Sep 15, 2014 |
| Ubuntu | — | Upgrade libc6 | Nov 8, 2024 | Dec 5, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub