CVE-2016-10228: Input Validation
First published: Thu Mar 02 2017(Updated: )
GNU C Library (glibc) is vulnerable to a denial of service, caused by an error in the iconv program. By processing invalid multi-byte input sequences, a remote attacker could exploit this vulnerability to cause the application to enter into an infinite loop.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNU glibc | <=2.25 | |
| IBM Security Verify Access | <=10.0.0 | |
| debian/glibc | 2.31-13+deb11u11 2.31-13+deb11u10 2.36-9+deb12u8 2.36-9+deb12u7 2.40-3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://openwall.com/lists/oss-security/2017/03/01/10
- http://www.securityfocus.com/bid/96525
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
- https://security.gentoo.org/glsa/202101-20
- https://sourceware.org/bugzilla/show_bug.cgi?id=19519
- https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21
- https://sourceware.org/bugzilla/show_bug.cgi?id=26224
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://launchpad.net/bugs/cve/CVE-2016-10228
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
- https://exchange.xforce.ibmcloud.com/vulnerabilities/124078
- https://www.ibm.com/support/pages/node/6538418 (Advisory)
- https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=91927b7c76437db860cd86a7714476b56bb39d07
- https://security-tracker.debian.org/tracker/CVE-2016-10228
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10228
- https://nvd.nist.gov/vuln/detail/CVE-2016-10228
- https://ubuntu.com/security/CVE-2016-10228
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2016-10228.
What is the severity of CVE-2016-10228?
The severity of CVE-2016-10228 is medium with a CVSS score of 5.9.
Which software versions are affected by CVE-2016-10228?
The GNU C Library (glibc) versions 2.31 and earlier, as well as IBM Security Verify Access version 10.0.0, are affected by CVE-2016-10228.
What is the impact of CVE-2016-10228?
CVE-2016-10228 can lead to a denial of service due to an infinite loop when processing invalid multi-byte input sequences.
Where can I find more information about CVE-2016-10228?
You can find more information about CVE-2016-10228 in the following references: [link1], [link2], [link3].
- collector/nvd-index
- agent/type
- agent/severity
- agent/weakness
- agent/remedy
- agent/first-publish-date
- agent/description
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/references
- collector/ibm-support
- source/IBM
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- vendor/gnu
- canonical/gnu glibc
- version/gnu glibc/2.25
- vendor/ibm
- canonical/ibm security verify access
- version/ibm security verify access/10.0.0
- package-manager/debian