REDHAT-BUG-2453117: Medium severity GNU GNU C Library vulnerability
The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.
This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove the affected component from your environment.
Remove the IBM1390 and IBM1399 character sets from systems that do not need them to mitigate the iconv() assertion-failure crash.
Event History
Frequently Asked Questions
Which systems are exposed to a remote crash?
Applications using iconv() to convert input from the IBM1390 or IBM1399 character sets are exposed. Remote impact is possible when an attacker can cause such an application to process attacker-controlled input in either character set.
What can be done if an update cannot be applied immediately?
Remove the IBM1390 and IBM1399 character sets from systems that do not require them. This is identified as a trivial mitigation.
How can I determine whether this issue is relevant to an application?
Check whether the application uses iconv() and performs conversions from IBM1390 or IBM1399. Systems that do not need or use those character sets can mitigate exposure by removing them.