5.9med
CVE-2016-10228
The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encodi…
Published 9 y ago · modified 24 d ago · JSON
CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.1%
percentile 91%
Public exploits
0
none known
Summary
The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.
Exploit prediction (EPSS)
4.11% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Affected products
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- securityfocus.com /bid/96525 · vdb-entry, x_transferred
- security.gentoo.org /glsa/202101-20 · vendor-advisory, x_transferred
- lists.apache.org /thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apach · mailing-list, x_transferred
- oracle.com /security-alerts/cpuapr2022.html · x_transferred
- sourceware.org /bugzilla/show_bug.cgi?id=19519 · x_transferred
- openwall.com /lists/oss-security/2017/03/01/10 · x_transferred
- sourceware.org /bugzilla/show_bug.cgi?id=19519#c21 · x_transferred
- sourceware.org /bugzilla/show_bug.cgi?id=26224 · x_transferred
- lists.debian.org /debian-lts-announce/2022/10/msg00021.html · mailing-list, x_transferred
- cert-portal.siemens.com /productcert/html/ssa-831302.html
- cert-portal.siemens.com /productcert/html/ssa-398330.html
Sources
- CVE List: CVE-2016-10228
- NVD: CVE-2016-10228
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.