diff mbox series

NEWS: Mention CVE-2021-3326 (iconv assertion with ISO-20220-JP-3)

Message ID 87tuqzwvoh.fsf@oldenburg.str.redhat.com
State Superseded
Headers
Series NEWS: Mention CVE-2021-3326 (iconv assertion with ISO-20220-JP-3) |

Commit Message

Florian Weimer Jan. 29, 2021, 4:32 p.m. UTC 
  ---
 NEWS | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

Paul Zimmermann Jan. 29, 2021, 4:38 p.m. UTC | #1 
Dear Florian,

> +  CVE-2021-3326: An assertion failure during conversion from from the

duplicate "from"

> +  qISO-20220-JP-3 character set using the iconv function has been fixed.
> +  This assertion wis triggered by certain valid inputs in which the

wis -> was

> +  converted output contains a combined sequence of two wide characters
> +  crossing a buffer boundary.  Reported by Tavis Ormandy.

Paul
Florian Weimer Jan. 29, 2021, 4:39 p.m. UTC | #2 
* Paul Zimmermann:

>        Dear Florian,
>
>> +  CVE-2021-3326: An assertion failure during conversion from from the
>
> duplicate "from"
>
>> +  qISO-20220-JP-3 character set using the iconv function has been fixed.
>> +  This assertion wis triggered by certain valid inputs in which the
>
> wis -> was
>
>> +  converted output contains a combined sequence of two wide characters
>> +  crossing a buffer boundary.  Reported by Tavis Ormandy.

Thanks, will send a v2.

Florian
diff mbox series

Patch

diff --git a/NEWS b/NEWS
index 6521a4f5b7..01cbf282c3 100644
--- a/NEWS
+++ b/NEWS
@@ -102,6 +102,12 @@  Changes to build and runtime requirements:
 
 Security related changes:
 
+  CVE-2021-3326: An assertion failure during conversion from from the
+  qISO-20220-JP-3 character set using the iconv function has been fixed.
+  This assertion wis triggered by certain valid inputs in which the
+  converted output contains a combined sequence of two wide characters
+  crossing a buffer boundary.  Reported by Tavis Ormandy.
+
   CVE-2020-27618: An infinite loop has been fixed in the iconv program when
   invoked with input containing redundant shift sequences in the IBM1364,
   IBM1371, IBM1388, IBM1390, or IBM1399 character sets.