[Git][security-tracker-team/security-tracker][master] Add CVE-2021-43396/glibc (issue introduced due to fix fo CVE-2021-3326)

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
79235907 by Salvatore Bonaccorso at 2021-11-05T06:51:06+01:00
Add CVE-2021-43396/glibc (issue introduced due to fix fo CVE-2021-3326)

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,10 @@
+CVE-2021-43396 [Conversion from ISO-2022-JP-3 with iconv may emit spurious NUL character on state reset]
+	- glibc <unfixed>
+	[buster] - glibc <not-affected> (Vulnerable code not present)
+	[stretch] - glibc <not-affected> (Vulnerable code not present)
+	NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=28524
+	NOTE: Fixed by: https://sourceware.org/git/?p=glibc.git;a=commit;h=ff012870b2c02a62598c04daa1e54632e020fd7d
+	NOTE: Introduced by the fix for CVE-2021-3326 / BZ#27256: https://sourceware.org/git/?p=glibc.git;a=commit;h=7d88c6142c6efc160c0ee5e4f85cde382c072888
 CVE-2021-43391
 	RESERVED
 CVE-2021-43390
@@ -43893,6 +43900,8 @@ CVE-2021-3326 (The iconv function in the GNU C Library (aka glibc or libc6) 2.32
 	NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=27256
 	NOTE: https://sourceware.org/pipermail/libc-alpha/2021-January/122058.html
 	NOTE: Fixed by: https://sourceware.org/git/?p=glibc.git;a=commit;h=7d88c6142c6efc160c0ee5e4f85cde382c072888
+	NOTE: When fixing the isuse for older suites make sure to not open up CVE-2021-43396
+	NOTE: and make a complete fix.
 CVE-2021-3317 (KLog Server through 2.4.1 allows authenticated command injection. asyn ...)
 	NOT-FOR-US: KLog Server
 CVE-2021-3316



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/79235907bc978f09b1c9724f604c317440476118

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/79235907bc978f09b1c9724f604c317440476118
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20211105/3dcf09f3/attachment.htm>