CVE-2021-3326

Published: Jan 27, 2021Modified: Jun 9, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

Affected (17)

Products: Gnu: Glibc · Netapp: E Series Santricity Os Controller, Ontap Select Deploy Administration Utility · Oracle: Communications Cloud Native Core Security Edge Protection Proxy · +2 more

Show all products

Gnu: Glibc · Netapp: E Series Santricity Os Controller, Ontap Select Deploy Administration Utility · Oracle: Communications Cloud Native Core Security Edge Protection Proxy · Fujitsu: M10 1 Firmware, M10 4 Firmware, M10 4s Firmware, M12 1 Firmware, M12 2 Firmware, M12 2s Firmware · Debian: Debian Linux

Gnu

1 product

Glibc

Netapp

2 products

E Series Santricity Os Controller

Ontap Select Deploy Administration Utility

Oracle

1 product

Communications Cloud Native Core Security Edge Protection Proxy

6 products

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Glibc	Up to 2.32.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Netapp E Series Santricity Os Controller	From 11.0 to 11.60.3
Netapp Ontap Select Deploy Administration Utility	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Security Edge Protection Proxy	Version 1.5.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 1 Firmware	Before xcp2410

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 4 Firmware	Before xcp2410

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M10 4s Firmware	Before xcp2410

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 1 Firmware	Before xcp2410

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 2 Firmware	Before xcp2410

Configuration J

1 vulnerable

Vulnerable Software	Affected Versions
Fujitsu M12 2s Firmware	Before xcp2410

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 1 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M10 1	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M10 4	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4s Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M10 4s	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 1 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 1	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2 Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 2	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2s Firmware	Before xcp3110

Running on/with	Platform Versions
Fujitsu M12 2s	All versions

Configuration R

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (16)

http://www.openwall.com/lists/oss-security/2021/01/28/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202107-07

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210304-0007/

Source: cve@mitre.org

Third Party Advisory

https://sourceware.org/bugzilla/show_bug.cgi?id=27256

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=7d88c6142c6efc160c0ee5e4f85cde382c072888

Source: cve@mitre.org

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: cve@mitre.org

Not Applicable

https://www.oracle.com/security-alerts/cpujan2022.html

Source: cve@mitre.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/01/28/2