CVE-2014-6040

glibc < 2.20 - Denial of Service via iconv Multibyte Character Handling

Title source: llm
STIX 2.1

Description

GNU C Library (aka glibc) before 2.20 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a multibyte character value of "0xffff" to the iconv function when converting (1) IBM933, (2) IBM935, (3) IBM937, (4) IBM939, or (5) IBM1364 encoded data to UTF-8.

References (12)

Core 12
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/69472
Various Sources x_refsource_confirm
http://linux.oracle.com/errata/ELSA-2015-0016.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201602-02
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2014:175
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/08/29/3
Patch, Vendor Advisory vendor-advisory x_refsource_ubuntu
http://ubuntu.com/usn/usn-2432-1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62100
Exploit mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/09/02/1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62146
Vendor Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2015/dsa-3142

Scores

EPSS 0.0719
EPSS Percentile 91.7%

Details

CWE
CWE-119
Status published
Products (29)
gnu/glibc 2.0
gnu/glibc 2.0.1
gnu/glibc 2.0.2
gnu/glibc 2.0.3
gnu/glibc 2.0.4
gnu/glibc 2.0.5
gnu/glibc 2.0.6
gnu/glibc 2.1
gnu/glibc 2.1.1
gnu/glibc 2.1.1.6
... and 19 more
Published Dec 05, 2014
Tracked Since Feb 18, 2026