CVE-2021-3326
First published: Wed Jan 27 2021(Updated: )
GNU C Library (aka glibc or libc6) is vulnerable to a denial of service, caused by an assertion failure when processing invalid input sequences in the ISO-2022-JP-3 encoding in the iconv function. By sending specially-crafted input, a remote attacker could exploit this vulnerability to cause the application to crash.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNU glibc | <=2.32.0 | |
| NetApp E-Series SANtricity OS Controller | >=11.0<=11.60.3 | |
| NetApp ONTAP Select Deploy administration utility | ||
| Oracle Communications Cloud Native Core Security Edge Protection Proxy | =1.5.0 | |
| Fujitsu M10-1 Firmware | <xcp2410 | |
| Fujitsu M10-1 | ||
| Fujitsu M10-4 Firmware | <xcp2410 | |
| Fujitsu M10-4 | ||
| Fujitsu M10-4s Firmware | <xcp2410 | |
| Fujitsu M10-4s | ||
| Fujitsu M12-1 Firmware | <xcp2410 | |
| Fujitsu M12-1 | ||
| Fujitsu M12-2 Firmware | <xcp2410 | |
| Fujitsu M12-2 | ||
| Fujitsu M12-2s Firmware | <xcp2410 | |
| Fujitsu M12-2s | ||
| Fujitsu M10-1 Firmware | <xcp3110 | |
| Fujitsu M10-4 Firmware | <xcp3110 | |
| Fujitsu M10-4s Firmware | <xcp3110 | |
| Fujitsu M12-1 Firmware | <xcp3110 | |
| Fujitsu M12-2 Firmware | <xcp3110 | |
| Fujitsu M12-2s Firmware | <xcp3110 | |
| Debian Debian Linux | =10.0 | |
| All of | ||
| Fujitsu M10-1 | ||
| Fujitsu M10-1 Firmware | <xcp2410 | |
| All of | ||
| Fujitsu M10-4 | ||
| Fujitsu M10-4 Firmware | <xcp2410 | |
| All of | ||
| Fujitsu M10-4s | ||
| Fujitsu M10-4s Firmware | <xcp2410 | |
| All of | ||
| Fujitsu M12-1 Firmware | <xcp2410 | |
| Fujitsu M12-1 | ||
| All of | ||
| Fujitsu M12-2 Firmware | <xcp2410 | |
| Fujitsu M12-2 | ||
| All of | ||
| Fujitsu M12-2s Firmware | <xcp2410 | |
| Fujitsu M12-2s | ||
| All of | ||
| Fujitsu M10-1 Firmware | <xcp3110 | |
| Fujitsu M10-1 | ||
| All of | ||
| Fujitsu M10-4 Firmware | <xcp3110 | |
| Fujitsu M10-4 | ||
| All of | ||
| Fujitsu M10-4s Firmware | <xcp3110 | |
| Fujitsu M10-4s | ||
| All of | ||
| Fujitsu M12-1 Firmware | <xcp3110 | |
| Fujitsu M12-1 | ||
| All of | ||
| Fujitsu M12-2 Firmware | <xcp3110 | |
| Fujitsu M12-2 | ||
| All of | ||
| Fujitsu M12-2s Firmware | <xcp3110 | |
| Fujitsu M12-2s | ||
| IBM Security Verify Access | <=10.0.0 | |
| debian/glibc | 2.31-13+deb11u11 2.31-13+deb11u10 2.36-9+deb12u8 2.36-9+deb12u7 2.40-3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2021/01/28/2
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
- https://security.gentoo.org/glsa/202107-07
- https://security.netapp.com/advisory/ntap-20210304-0007/
- https://sourceware.org/bugzilla/show_bug.cgi?id=27256
- https://sourceware.org/git/?p=glibc.git;a=commit;h=7d88c6142c6efc160c0ee5e4f85cde382c072888
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://launchpad.net/bugs/cve/CVE-2021-3326
- https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=7d88c6142c6efc160c0ee5e4f85cde382c072888
- https://exchange.xforce.ibmcloud.com/vulnerabilities/195732
- https://www.ibm.com/support/pages/node/6538418 (Advisory)
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2146
- https://sourceware.org/pipermail/libc-alpha/2021-January/122058.html
- https://security-tracker.debian.org/tracker/CVE-2021-3326
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3326
- https://nvd.nist.gov/vuln/detail/CVE-2021-3326
- https://ubuntu.com/security/CVE-2021-3326
Frequently Asked Questions
What is CVE-2021-3326?
CVE-2021-3326 is a vulnerability in the GNU C Library (glibc) that allows for a denial of service attack.
How severe is CVE-2021-3326?
CVE-2021-3326 has a severity score of 7.5, which is considered high.
Which software versions are affected by CVE-2021-3326?
IBM Security Verify Access 10.0.0, GNU glibc up to version 2.32.0, and NetApp E-Series SANtricity OS Controller versions between 11.0 and 11.60.3 are affected by CVE-2021-3326.
How can I fix CVE-2021-3326?
To fix CVE-2021-3326, you should update to a version of the affected software that includes a patch for the vulnerability.
Where can I find more information about CVE-2021-3326?
You can find more information about CVE-2021-3326 in the references provided: [1], [2], [3].
- agent/type
- agent/remedy
- agent/severity
- agent/weakness
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/first-publish-date
- agent/description
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/references
- collector/ibm-support
- source/IBM
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- vendor/gnu
- canonical/gnu glibc
- version/gnu glibc/2.32.0
- vendor/netapp
- canonical/netapp e-series santricity os controller
- version/netapp e-series santricity os controller/11.0
- version/netapp e-series santricity os controller/11.60.3
- canonical/netapp ontap select deploy administration utility
- vendor/oracle
- canonical/oracle communications cloud native core security edge protection proxy
- version/oracle communications cloud native core security edge protection proxy/1.5.0
- vendor/fujitsu
- canonical/fujitsu m10-1 firmware
- canonical/fujitsu m10-1
- canonical/fujitsu m10-4 firmware
- canonical/fujitsu m10-4
- canonical/fujitsu m10-4s firmware
- canonical/fujitsu m10-4s
- canonical/fujitsu m12-1 firmware
- canonical/fujitsu m12-1
- canonical/fujitsu m12-2 firmware
- canonical/fujitsu m12-2
- canonical/fujitsu m12-2s firmware
- canonical/fujitsu m12-2s
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- vendor/ibm
- canonical/ibm security verify access
- version/ibm security verify access/10.0.0
- package-manager/debian