Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibc-commonUpgrade glibc-staticUpgrade glibc-utilsUpgrade glibc-develUpgrade glibc-headersUpgrade nscdUpgrade glibc | Dec 1, 2016 | Aug 29, 2014 |
| Debian | — | Upgrade glibcUpgrade eglibc | Jul 30, 2024 | Aug 29, 2014 |
| Gentoo Linux | — | Upgrade sys-libs/glibc. | Oct 30, 2017 | Aug 29, 2014 |
| Oracle_linux | — | Upgrade glibc-staticUpgrade nscdUpgrade glibcUpgrade glibc-headersUpgrade glibc-utilsUpgrade glibc-develUpgrade glibc-common | Oct 16, 2024 | Aug 29, 2014 |
| Suse | — | Upgrade pwdutils-plugin-auditUpgrade glibc-htmlUpgrade glibc-i18ndataUpgrade libxcrypt-32bitUpgrade glibc-develUpgrade glibc-locale-baseUpgrade pam-modules-32bitUpgrade glibc-localeUpgrade glibc-devel-32bitUpgrade glibc-locale-32bitUpgrade glibc-devel-staticUpgrade glibc-utilsUpgrade nscdUpgrade glibcUpgrade glibc-profile-32bitUpgrade pam-modulesUpgrade glibc-32bitUpgrade pwdutilsUpgrade glibc-profile-x86Upgrade libxcryptUpgrade glibc-locale-x86Upgrade glibc-infoUpgrade glibc-extraUpgrade glibc-profileUpgrade glibc-x86 | Dec 18, 2015 | Aug 29, 2014 |
| Ubuntu | — | Upgrade libc6 | Nov 8, 2024 | Aug 29, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub