Description
In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.32-5 | — |
| Debian 13 | glibc | 2.32-5 | — |
| Debian 12 | glibc | 2.32-5 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nscd +217 | 2.34-181.amzn2023.0.1 | ALAS2023-2025-988 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | glibc | 2.35-1 | — |
Advisories 3
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- ALAS2023-2025-988 Moderate: glibc security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 2, 2025
References
- https://sourceware.org/bugzilla/show_bug.cgi?id=28524
- https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=ff012870b2c02a62598c04daa1e54632e020fd7d
- https://blog.tuxcare.com/vulnerability/vulnerability-in-iconv-identified-by-tuxcare-team-cve-2021-43396
- https://www.oracle.com/security-alerts/cpujul2022.html