GNU C Library vulnerabilities

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set. This may lead to application crashes or overwrite a neighbouring variable.

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

In GNU C Library versions 2.13 to 2.40, when the assert() function fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).

Vulnerability in the GNU C Library (glibc) versions 2.7 through 2.43. Calling scanf family functions with %mc (malloc'd character match) and an explicit width greater than 1024 can cause a one-byte heap buffer overflow.

Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.

Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.

In the GNU C Library (glibc) versions 2.0.1 through 2.43, a vulnerability exists in the deprecated functions ns_printrrf, ns_printrr, and fp_nquery. These functions fail to validate RDATA content against RDATA length in DNS responses for A6, CERT, LOC, TKEY, or TSIG records, potentially allowing an attacker to craft a DNS response causing application crash or uninitialized memory read.

In the GNU C Library (glibc) version 2.2 and later, the deprecated functions ns_printrrf, ns_printrr, and fp_nquery fail to enforce the caller-supplied buffer length, which can lead to an out-of-bounds write when printing TSIG records.

In the GNU C Library version 2.43 and earlier, calling ungetwc on a FILE stream with wide characters encoded in a character set that has overlaps between single-byte and multi-byte encodings may cause an out-of-bounds read before an allocated buffer. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail) causes ungetwc to operate on the regular character buffer instead of the wide-stream read pointer, potentially leading to disclosure of heap data or a program crash.

The iconv() function in GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from IBM1390 or IBM1399 character sets. This vulnerability can be exploited remotely to crash an application.

A vulnerability in the GNU C Library (glibc) versions 2.34 through 2.43 causes calls to gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf specifying the DNS backend to return an invalid DNS hostname, violating the DNS specification.

A vulnerability in GNU C Library (glibc) versions 2.34 to 2.43 allows an attacker to violate DNS specifications via a crafted DNS server response. Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend may cause the application to treat a non-answer section of the DNS response as a valid answer.

In the GNU C Library version 2.36 on x86_64 systems, calling functions that use nscd caching may cause a crash. The issue stems from an optimized memcmp implementation that, when inputs are concurrently modified by other threads, can crash the nscd client and the application using it.