Buffer Over-read in GNU C Library's Iconv Feature Processing EUC-KR Encoding
CVE-2019-25013

5.9MEDIUM

Key Information:

Vendor

Gnu
Status
Glibc
Vendor
CVE Published:
4 January 2021

What is CVE-2019-25013?

The iconv feature in the GNU C Library (glibc) through version 2.32 is susceptible to a buffer over-read when it encounters invalid multi-byte input sequences in the EUC-KR encoding. This flaw could allow an attacker to potentially read sensitive memory contents, leading to unintended information disclosure or other unpredictable behavior in applications that rely on this library for text processing.

References

https://sourceware.org/bugzilla/show_bug.cgi?id=24973
https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=ee...
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.