CVE-2024-2961

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-2961
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/04/17/9 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/18/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/24/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/3 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/5 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/6 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/07/22/5 Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/ Broken Link
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/ Broken Link
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/ Broken Link
https://security.netapp.com/advisory/ntap-20240531-0002/ Third Party Advisory
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004 Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/17/9 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/18/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/24/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/3 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/5 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/05/27/6 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/07/22/5 Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/ Broken Link
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/ Broken Link
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/ Broken Link
https://security.netapp.com/advisory/ntap-20240531-0002/ Third Party Advisory
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004 Third Party Advisory
https://www.ambionics.io/blog/iconv-cve-2024-2961-p1 Broken Link
https://www.ambionics.io/blog/iconv-cve-2024-2961-p2 Broken Link
https://www.ambionics.io/blog/iconv-cve-2024-2961-p3 Broken Link
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netapp:hci_h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h300s:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netapp:hci_h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h500s:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:hci_h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h700s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:hci_h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h410s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h410c:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:hci_h610c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h610c:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netapp:hci_h610s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h610s:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netapp:hci_h615c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h615c:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Configuration 11 (hide)

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
History

03 Apr 2026, 16:36

Type Values Removed Values Added
First Time Netapp hci Compute Node
Netapp hci H410c Firmware
Netapp hci H615c
Gnu glibc
Netapp hci H610s Firmware
Netapp hci H410c
Netapp hci H500s Firmware
Netapp
Netapp hci H700s Firmware
Netapp hci H410s Firmware
Netapp hci H610c
Netapp hci H410s
Netapp active Iq Unified Manager
Netapp hci H615c Firmware
Debian
Netapp ontap Select Deploy Administration Utility
Netapp hci H500s
Netapp hci H300s
Netapp hci H610s
Netapp hci H610c Firmware
Netapp hci H700s
Netapp hci H300s Firmware
Gnu
Debian debian Linux
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_h610s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h615c:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h610c:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_h610c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h410s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h500s:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:h:netapp:hci_h610s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h700s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h410c:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_h615c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_h300s:-:*:*:*:*:*:*:*
References () http://www.openwall.com/lists/oss-security/2024/04/17/9 - () http://www.openwall.com/lists/oss-security/2024/04/17/9 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/04/18/4 - () http://www.openwall.com/lists/oss-security/2024/04/18/4 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/04/24/2 - () http://www.openwall.com/lists/oss-security/2024/04/24/2 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/05/27/1 - () http://www.openwall.com/lists/oss-security/2024/05/27/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/05/27/2 - () http://www.openwall.com/lists/oss-security/2024/05/27/2 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/05/27/3 - () http://www.openwall.com/lists/oss-security/2024/05/27/3 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/05/27/4 - () http://www.openwall.com/lists/oss-security/2024/05/27/4 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/05/27/5 - () http://www.openwall.com/lists/oss-security/2024/05/27/5 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/05/27/6 - () http://www.openwall.com/lists/oss-security/2024/05/27/6 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2024/07/22/5 - () http://www.openwall.com/lists/oss-security/2024/07/22/5 - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html - () https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/ - Broken Link
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/ - Broken Link
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/ - Broken Link
References () https://security.netapp.com/advisory/ntap-20240531-0002/ - () https://security.netapp.com/advisory/ntap-20240531-0002/ - Third Party Advisory
References () https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004 - () https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004 - Third Party Advisory
References () https://www.ambionics.io/blog/iconv-cve-2024-2961-p1 - () https://www.ambionics.io/blog/iconv-cve-2024-2961-p1 - Broken Link
References () https://www.ambionics.io/blog/iconv-cve-2024-2961-p2 - () https://www.ambionics.io/blog/iconv-cve-2024-2961-p2 - Broken Link
References () https://www.ambionics.io/blog/iconv-cve-2024-2961-p3 - () https://www.ambionics.io/blog/iconv-cve-2024-2961-p3 - Broken Link

13 Feb 2025, 18:17

Type Values Removed Values Added
Summary (en) The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. (en) The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

21 Nov 2024, 09:10

Type Values Removed Values Added
References
  • () https://www.ambionics.io/blog/iconv-cve-2024-2961-p1 -
  • () https://www.ambionics.io/blog/iconv-cve-2024-2961-p2 -
  • () https://www.ambionics.io/blog/iconv-cve-2024-2961-p3 -
References () http://www.openwall.com/lists/oss-security/2024/04/17/9 - () http://www.openwall.com/lists/oss-security/2024/04/17/9 -
References () http://www.openwall.com/lists/oss-security/2024/04/18/4 - () http://www.openwall.com/lists/oss-security/2024/04/18/4 -
References () http://www.openwall.com/lists/oss-security/2024/04/24/2 - () http://www.openwall.com/lists/oss-security/2024/04/24/2 -
References () http://www.openwall.com/lists/oss-security/2024/05/27/1 - () http://www.openwall.com/lists/oss-security/2024/05/27/1 -
References () http://www.openwall.com/lists/oss-security/2024/05/27/2 - () http://www.openwall.com/lists/oss-security/2024/05/27/2 -
References () http://www.openwall.com/lists/oss-security/2024/05/27/3 - () http://www.openwall.com/lists/oss-security/2024/05/27/3 -
References () http://www.openwall.com/lists/oss-security/2024/05/27/4 - () http://www.openwall.com/lists/oss-security/2024/05/27/4 -
References () http://www.openwall.com/lists/oss-security/2024/05/27/5 - () http://www.openwall.com/lists/oss-security/2024/05/27/5 -
References () http://www.openwall.com/lists/oss-security/2024/05/27/6 - () http://www.openwall.com/lists/oss-security/2024/05/27/6 -
References () http://www.openwall.com/lists/oss-security/2024/07/22/5 - () http://www.openwall.com/lists/oss-security/2024/07/22/5 -
References () https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html - () https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/ -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/ -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/ -
References () https://security.netapp.com/advisory/ntap-20240531-0002/ - () https://security.netapp.com/advisory/ntap-20240531-0002/ -
References () https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004 - () https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004 -

22 Jul 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/07/22/5 -

03 Jul 2024, 01:53

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.3

10 Jun 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/05/27/3 -
  • () http://www.openwall.com/lists/oss-security/2024/05/27/4 -
  • () http://www.openwall.com/lists/oss-security/2024/05/27/5 -
  • () https://security.netapp.com/advisory/ntap-20240531-0002/ -

10 Jun 2024, 17:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/05/27/1 -
  • () http://www.openwall.com/lists/oss-security/2024/05/27/2 -
  • () http://www.openwall.com/lists/oss-security/2024/05/27/6 -

04 May 2024, 01:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html -

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/04/17/9 -
  • () http://www.openwall.com/lists/oss-security/2024/04/18/4 -

01 May 2024, 17:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/04/24/2 -

20 Apr 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/ -

20 Apr 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/ -

19 Apr 2024, 23:15

Type Values Removed Values Added
Summary
  • (es) La función iconv() en las versiones 2.39 y anteriores de la librería GNU C puede desbordar el búfer de salida que se le pasa hasta en 4 bytes al convertir cadenas al juego de caracteres ISO-2022-CN-EXT, lo que puede usarse para bloquear una aplicación. o sobrescribir una variable vecina.
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/ -

17 Apr 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-17 18:15

Updated : 2026-04-03 16:36

NVD link : CVE-2024-2961

Mitre link : CVE-2024-2961

CVE.ORG link : CVE-2024-2961

JSON object : View

Products Affected

netapp

  • hci_h700s_firmware
  • hci_h300s_firmware
  • hci_h410s_firmware
  • hci_h700s
  • hci_h410c
  • hci_h615c
  • hci_h615c_firmware
  • hci_h300s
  • hci_h500s
  • hci_h610c
  • active_iq_unified_manager
  • hci_h610s_firmware
  • hci_compute_node
  • hci_h410s
  • hci_h500s_firmware
  • hci_h610s
  • hci_h410c_firmware
  • hci_h610c_firmware
  • ontap_select_deploy_administration_utility

gnu

  • glibc

debian

  • debian_linux
CWE
CWE-787

Out-of-bounds Write