CVE-2019-25013: Medium severity IBM Security Verify Access vulnerability
GNU glibc is vulnerable to a denial of service, caused by a buffer over-read in iconv feature. By sending a specially-crafted request, a remote attacker could exploit this vulnerability to cause a SIGSEGV.
Other sources
The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/glibcto a version that resolves this vulnerability.Fixed in 2.31-13+deb11u11Fixed in 2.31-13+deb11u10Fixed in 2.36-9+deb12u10Fixed in 2.36-9+deb12u7Fixed in 2.41-7
Event History
Frequently Asked Questions
What is CVE-2019-25013?
CVE-2019-25013 is a vulnerability in the iconv feature of GNU glibc that can be exploited by a remote attacker to cause a denial of service.
How severe is CVE-2019-25013?
CVE-2019-25013 has a severity value of 7.5, which is considered high.
Which software versions are affected by CVE-2019-25013?
IBM Security Verify Access 10.0.0, GNU glibc up to version 2.32, Fedoraproject Fedora 32 and 33, NetApp ONTAP Select Deploy administration utility, NetApp Service Processor, Broadcom Fabric Operating System, Netapp Baseboard Management Controller A250 Firmware, and Debian Debian Linux 10.0 are affected by CVE-2019-25013.
How can CVE-2019-25013 be exploited?
CVE-2019-25013 can be exploited by sending a specially-crafted request to the iconv feature of GNU glibc, causing a SIGSEGV.
Are there any references for CVE-2019-25013?
Yes, you can find more information about CVE-2019-25013 at the following references: [IBM X-Force Exchange](https://exchange.xforce.ibmcloud.com/vulnerabilities/194579), [IBM Support](https://www.ibm.com/support/pages/node/6538418), [Apache Kafka Mailing List](https://lists.apache.org/thread.html/r32d767ac804e9b8aad4355bb85960a6a1385eab7afff549a5e98660f@%3Cjira.kafka.apache.org%3E).