CVE-2021-43396

Name	CVE-2021-43396
Description	DISPUTED In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug."
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium
Debian Bugs	998622

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glibc (PTS)	stretch	2.24-11+deb9u4	fixed
	stretch (security)	2.24-11+deb9u1	fixed
	buster	2.28-10	fixed
	bullseye	2.31-13+deb11u2	vulnerable
	bookworm, sid	2.32-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
glibc	source	stretch	(not affected)
glibc	source	buster	(not affected)
glibc	source	(unstable)	2.32-5	unimportant	998622

Notes

[buster] - glibc <not-affected> (Vulnerable code not present)
[stretch] - glibc <not-affected> (Vulnerable code not present)
https://sourceware.org/bugzilla/show_bug.cgi?id=28524
Fixed by: https://sourceware.org/git/?p=glibc.git;a=commit;h=ff012870b2c02a62598c04daa1e54632e020fd7d
Introduced by the fix for CVE-2021-3326 / BZ#27256: https://sourceware.org/git/?p=glibc.git;a=commit;h=7d88c6142c6efc160c0ee5e4f85cde382c072888
No security impact per upstream assessment