security-tracker.debian.org Open in urlscan Pro
2a04:4e42:77::644  Public Scan

Form analysis
1 forms found in the DOM

GET /tracker/

<form method="get" id="searchform" action="/tracker/">Search for package or bug name: <input type="text" name="query" onkeyup="onSearch(this.value)" onmousemove="onSearch(this.value)"><input type="submit" value="Go">
  <a href="/tracker/data/report">Reporting problems</a></form>

Text Content

CVE-2024-2961

NameCVE-2024-2961DescriptionThe iconv() function in the GNU C Library versions
2.39 and older may overflow the output buffer passed to it by up to 4 bytes when
converting strings to the ISO-2022-CN-EXT character set, which may be used to
crash an application or overwrite a neighbouring variable.SourceCVE (at NVD;
CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub
advisories/code/issues, web search, more)ReferencesDLA-3807-1, DSA-5673-1Debian
Bugs1069191


VULNERABLE AND FIXED PACKAGES

The table below lists information on source packages.

Source PackageReleaseVersionStatusglibc
(PTS)bullseye2.31-13+deb11u11fixedbullseye
(security)2.31-13+deb11u10fixedbookworm2.36-9+deb12u8fixedbookworm
(security)2.36-9+deb12u7fixedsid, trixie2.40-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian
Bugsglibcsourcebuster2.28-10+deb10u3DLA-3807-1glibcsourcebullseye2.31-13+deb11u9DSA-5673-1glibcsourcebookworm2.36-9+deb12u6DSA-5673-1glibcsource(unstable)2.37-181069191


NOTES

https://www.openwall.com/lists/oss-security/2024/04/17/9
https://www.openwall.com/lists/oss-security/2024/04/18/4
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004
Introduced by: https://sourceware.org/git?p=glibc.git;a=commit;h=755104edc75c53f4a0e7440334e944ad3c6b32fc (cvs/libc-2_1_94)
Fixed by: https://sourceware.org/git?p=glibc.git;a=commit;h=f9dc609e06b1136bb0408be9605ce7973a767ada
https://www.ambionics.io/blog/iconv-cve-2024-2961-p1
https://github.com/ambionics/cnext-exploits/


--------------------------------------------------------------------------------

Search for package or bug name: Reporting problems

Home - Debian Security - Source (Git)