A lib32-glibc security update has been released for Arch Linux.

Arch Linux Security Advisory ASA-202102-16
==========================================

Severity: Low
Date : 2021-02-07
CVE-ID : CVE-2019-25013 CVE-2020-27618 CVE-2020-29562 CVE-2021-3326
Package : lib32-glibc
Type : denial of service
Remote : No
Link :   https://security.archlinux.org/AVG-1320

Summary
=======

The package lib32-glibc before version 2.33-1 is vulnerable to denial
of service.

Resolution
==========

Upgrade to 2.33-1.

# pacman -Syu "lib32-glibc>=2.33-1"

The problems have been fixed upstream in version 2.33.

Workaround
==========

None.

Description
===========

- CVE-2019-25013 (denial of service)

The iconv feature in glibc up to version 2.32, when processing invalid
multi-byte input sequences in the EUC-KR encoding, may have a buffer
over-read. The issue is fixed in glibc version 2.33.

- CVE-2020-27618 (denial of service)

A flaw was found in glibc up to version 2.32. If an attacker provides
the iconv function with invalid multi-byte input sequences in IBM1364,
IBM1371, IBM1388, IBM1390, IBM1399 encodings, it fails to advance the
input state, which could lead to an infinite loop in applications,
resulting in a denial of service. The issue is fixed in glibc version
2.33.

- CVE-2020-29562 (denial of service)

The iconv function in glibc version 2.30 to 2.32, when converting UCS4
text containing an irreversible character, fails an assertion in the
code path and aborts the program, potentially resulting in a denial of
service. The issue is fixed in glibc version 2.33.

- CVE-2021-3326 (denial of service)

The iconv function in glibc version 2.32 and earlier, when processing
invalid input sequences in the ISO-2022-JP-3 encoding, fails an
assertion in the code path and aborts the program, potentially
resulting in a denial of service. The issue is fixed in glibc version
2.33.

Impact
======

A local attacker might cause a crash via specially crafted input.

References
==========

  https://sourceware.org/pipermail/libc-alpha/2021-February/122207.html
  https://sourceware.org/bugzilla/show_bug.cgi?id=24973
  https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ee7a3144c9922808181009b7b3e50e852fb4999b
  https://bugzilla.redhat.com/show_bug.cgi?id=1893708
  https://sourceware.org/bugzilla/show_bug.cgi?id=26224
  https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=9a99c682144bdbd40792ebf822fe9264e0376fb5
  https://sourceware.org/bugzilla/show_bug.cgi?id=26923
  https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=228edd356f03bf62dcf2b1335f25d43c602ee68d
  https://www.openwall.com/lists/oss-security/2021/01/27/3
  https://sourceware.org/bugzilla/show_bug.cgi?id=27256
  https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=7d88c6142c6efc160c0ee5e4f85cde382c072888
  https://security.archlinux.org/CVE-2019-25013
  https://security.archlinux.org/CVE-2020-27618
  https://security.archlinux.org/CVE-2020-29562
  https://security.archlinux.org/CVE-2021-3326