What’s Vulnerable › Vulnerabilities

CVE-2024-2961

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 88.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-17 · updated 2026-06-17
• Weakness: CWE-787

Description

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

Affected products

• Debian Linux: 10.0
• GNU C Library (glibc): from 2.1.93 before 2.40 — fixed in 2.40
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp Hci Compute Node: all versions
• NetApp Hci H300S Firmware: all versions
• NetApp Hci H410C Firmware: all versions
• NetApp Hci H410S Firmware: all versions
• NetApp Hci H500S Firmware: all versions
• NetApp Hci H610C Firmware: all versions
• NetApp HCI Baseboard Management Controller (BMC) HCI H610C, NetApp HCI Baseboard Management Controller (BMC) HCI H615C, : all versions
• NetApp Hci H615C Firmware: all versions
• NetApp Hci H700S Firmware: all versions
• NetApp ONTAP Select Deploy administration utility: all versions

How to fix

Upgrade to a fixed version: GNU C Library (glibc) 2.40. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/04/17/9
• http://www.openwall.com/lists/oss-security/2024/04/18/4
• http://www.openwall.com/lists/oss-security/2024/04/24/2
• http://www.openwall.com/lists/oss-security/2024/05/27/1
• http://www.openwall.com/lists/oss-security/2024/05/27/2
• http://www.openwall.com/lists/oss-security/2024/05/27/3
• http://www.openwall.com/lists/oss-security/2024/05/27/4
• http://www.openwall.com/lists/oss-security/2024/05/27/5
• http://www.openwall.com/lists/oss-security/2024/05/27/6
• http://www.openwall.com/lists/oss-security/2024/07/22/5
• https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/

Get alerted when CVE-2024-2961 or the next vulnerability affects your stack