Vulnerabilities > CVE-2021-43396

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

gnu

oracle

NVD

Published: 2021-11-04

Updated: 2024-04-11

Summary

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug.

Vulnerable Configurations

Part	Description	Count
Application	Gnu GNU Glibc 2.34	1
Application	Oracle Oracle Communications Cloud Native Core Network Function Cloud Native Environment 22.1.0 Oracle Communications Cloud Native Core Binding Support Function 22.1.3 Oracle Communications Cloud Native Core Network Repository Function 22.2.0 Oracle Communications Cloud Native Core Network Repository Function 22.1.2 Oracle Communications Cloud Native Core Security Edge Protection Proxy 22.1.1 Oracle Enterprise Operations Monitor 4.3 Oracle Enterprise Operations Monitor 4.4 Oracle Enterprise Operations Monitor 5.0 Oracle Communications Cloud Native Core Unified Data Repository 22.2.0	9

Vulnerabilities > CVE-2021-43396 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2021-43396"}]}

Summary

Vulnerable Configurations

References

Vulnerabilities > CVE-2021-43396