Vulnerability Description
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Glibc | <= 2.32 |
| Netapp | Ontap Select Deploy Administration Utility | - |
| Netapp | A250 Firmware | - |
| Netapp | A250 | - |
| Netapp | 500F Firmware | - |
| Netapp | 500F | - |
| Netapp | H410C Firmware | - |
| Netapp | H410C | - |
| Netapp | H300S Firmware | - |
| Netapp | H300S | - |
| Netapp | H500S Firmware | - |
| Netapp | H500S | - |
| Netapp | H700S Firmware | - |
| Netapp | H700S | - |
| Netapp | H300E Firmware | - |
| Netapp | H300E | - |
| Netapp | H500E Firmware | - |
| Netapp | H500E | - |
| Netapp | H700E Firmware | - |
| Netapp | H700E | - |
Related Weaknesses (CWE)
References
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202107-07Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210401-0006/Third Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21Issue TrackingPatchThird Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=26224ExploitIssue TrackingThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlNot ApplicableThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00021.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202107-07Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210401-0006/Third Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21Issue TrackingPatchThird Party Advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=26224ExploitIssue TrackingThird Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlNot ApplicableThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
FAQ
What is CVE-2020-27618?
CVE-2020-27618 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to...
How severe is CVE-2020-27618?
CVE-2020-27618 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-27618?
Check the references section above for vendor advisories and patch information. Affected products include: Gnu Glibc, Netapp Ontap Select Deploy Administration Utility, Netapp A250 Firmware, Netapp A250, Netapp 500F Firmware.