Bugzilla – Bug 1027496
VUL-1: CVE-2016-10228: glibc: iconv program can hang when invoked with the -c option
Last modified: 2024-05-13 14:32:54 UTC
Ref: http://seclists.org/oss-sec/2017/q1/538 ============================================= The iconv program (not the iconv function) provided by glibc can hang (enter an infinite loop) when invoked with the -c option and an invalid multi-byte sequence is encountered in the input: https://sourceware.org/bugzilla/show_bug.cgi?id=19519 We have received an independent report of this issue, so we are treating this as a (minor) security bug now on the glibc upstream side. (Note to Red Hat Product Security: We already have a couple of product bugs for this.) ============================================= https://sourceware.org/bugzilla/show_bug.cgi?id=19519 ====================================================== Jan Engelhardt 2016-01-25 18:41:47 UTC In glibc 2.19 and glibc 2.22, I observe that combining //translit with //ignore with -c with an unconvertible sequence will hang the iconv program. The order of //translit and //ignore is significant. The target charset is of no significance; it could also be -t utf-8//translit//ignore. echo -en '\x80' | iconv -f us-ascii -t us-ascii//translit//ignore -c ... Florian Weimer 2017-03-01 09:12:56 UTC Another reproducer: echo -en "\x0e\x0e" | /usr/bin/iconv -c -f IBM1364 We received an independent report of this issue, and I think we should treat this as a minor security bug. ====================================================== 42.2: k_mikhail@linux-mk500:~> ldd --version ldd (GNU libc) 2.22 Copyright (C) 2015 Free Software Foundation, Inc.
bugbot adjusting priority
as its only the commandline tool, planned update only. glibc 2.11 iconv also goes to 100% CPU, assuming it goes way back
SUSE-SU-2021:2480-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1027496,1131330,1187911 CVE References: CVE-2016-10228,CVE-2021-35942 JIRA References: Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): glibc-2.22-114.12.1 SUSE Linux Enterprise Server 12-SP5 (src): glibc-2.22-114.12.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
can you fix this also for SUSE:SLE-15:Update glibc please? partner has queried this.
SUSE-SU-2021:3830-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1027496,1183085 CVE References: CVE-2016-10228 JIRA References: Sources used: SUSE MicroOS 5.0 (src): glibc-2.26-13.62.1 SUSE Linux Enterprise Module for Development Tools 15-SP2 (src): glibc-2.26-13.62.1, glibc-utils-src-2.26-13.62.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): glibc-2.26-13.62.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:1560-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1027496,1183085 CVE References: CVE-2016-10228 JIRA References: Sources used: openSUSE Leap 15.2 (src): glibc-2.26-lp152.26.12.1, glibc-testsuite-src-2.26-lp152.26.12.1, glibc-utils-src-2.26-lp152.26.12.1
SUSE-SU-2022:2886-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 1027496,1178386,1179694,1179721,1181505,1182117,941234 CVE References: CVE-2015-5180,CVE-2016-10228,CVE-2019-25013,CVE-2020-27618,CVE-2020-29562,CVE-2020-29573,CVE-2021-3326 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP3-BCL (src): glibc-2.22-126.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): glibc-2.22-126.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done