GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibc-headersUpgrade nscdUpgrade glibc-commonUpgrade glibcUpgrade glibc-staticUpgrade glibc-utilsUpgrade glibc-devel | Dec 1, 2016 | Dec 5, 2014 |
| Debian | — | Upgrade eglibcUpgrade glibc | Jul 30, 2024 | Dec 5, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 16, 2015 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Dec 5, 2014 |
| Oracle_linux | — | Upgrade glibc-develUpgrade glibc-staticUpgrade nscdUpgrade glibcUpgrade glibc-headersUpgrade glibc-utilsUpgrade glibc-common | Oct 16, 2024 | Dec 5, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 28, 2014 |
| Suse | — | Upgrade pam-modules-32bitUpgrade libxcrypt-32bitUpgrade pwdutils-plugin-auditUpgrade glibc-htmlUpgrade glibc-develUpgrade glibc-locale-x86Upgrade glibc-localeUpgrade glibc-utilsUpgrade glibc-devel-staticUpgrade glibc-devel-32bitUpgrade glibc-locale-baseUpgrade glibc-i18ndataUpgrade pam-modulesUpgrade glibc-32bitUpgrade glibcUpgrade glibc-extraUpgrade glibc-profile-x86Upgrade glibc-infoUpgrade nscdUpgrade glibc-x86Upgrade glibc-profileUpgrade libxcryptUpgrade pwdutilsUpgrade glibc-profile-32bitUpgrade glibc-locale-32bit | Dec 18, 2015 | Sep 15, 2014 |
| Ubuntu | — | Upgrade libc6 | Nov 8, 2024 | Dec 5, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub