VulnerableCode Package Details - pkg:alpm/archlinux/glibc@2.33-5

Search for packages

Vulnerability	Summary	Fixed by
VCID-16q3-v9ba-aaar Aliases: CVE-2021-43396	DISPUTED In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug."	2.34-1 Affected by 0 other vulnerabilities.
VCID-3g4r-ex56-aaaa Aliases: CVE-2021-33574	The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.	2.34-1 Affected by 0 other vulnerabilities.
VCID-4ps4-wrmd-aaaj Aliases: CVE-2021-3999	A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.	2.34-1 Affected by 0 other vulnerabilities.
VCID-6xta-nuud-aaah Aliases: CVE-2021-38604	In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix.	There are no reported fixed by versions.
VCID-8dn8-f7r5-aaaa Aliases: CVE-2021-27645	The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.	2.34-1 Affected by 0 other vulnerabilities.
VCID-duwt-xt4y-aaaj Aliases: CVE-2021-35942	The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.	2.34-1 Affected by 0 other vulnerabilities.
VCID-n5ry-gsbb-aaaq Aliases: CVE-2021-3998	A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.	2.34-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-16q3-v9ba-aaar
Aliases:
CVE-2021-43396

** DISPUTED ** In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug."