CVE catalog

CVE-2024-2961

GNU C Library vulnerability

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
88.33% · Oct 25, 2026

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianglibcsid2.43-7fixed
Debianglibcforky2.43-7fixed
Debianglibctrixie2.41-12+deb13u4fixed
Debianglibcbookworm2.36-9+deb12u14fixed
Debianglibcbookworm-security2.36-9+deb12u7fixed
Ubuntuglibcnoble2.36-9+deb12u6fixed
Ubuntuglibcnoble2.39-0ubuntu8.1fixed
Ubuntuglibc-docnoble2.39-0ubuntu8.1fixed
Ubuntuglibc-sourcenoble2.39-0ubuntu8.1fixed
Ubuntulibc-binnoble2.39-0ubuntu8.1fixed
Ubuntulibc-dev-binnoble2.39-0ubuntu8.1fixed
Ubuntulibc-devtoolsnoble2.39-0ubuntu8.1fixed
Ubuntulibc6noble2.39-0ubuntu8.1fixed
Ubuntulibc6-amd64noble2.39-0ubuntu8.1fixed
Ubuntulibc6-devnoble2.39-0ubuntu8.1fixed
Ubuntulibc6-dev-amd64noble2.39-0ubuntu8.1fixed
Ubuntulibc6-dev-i386noble2.39-0ubuntu8.1fixed
Ubuntulibc6-dev-s390noble2.39-0ubuntu8.1fixed
Ubuntulibc6-dev-x32noble2.39-0ubuntu8.1fixed
Ubuntulibc6-i386noble2.39-0ubuntu8.1fixed
Ubuntulibc6-s390noble2.39-0ubuntu8.1fixed
Ubuntulibc6-x32noble2.39-0ubuntu8.1fixed
Ubuntulocalesnoble2.39-0ubuntu8.1fixed
Ubuntulocales-allnoble2.39-0ubuntu8.1fixed
Ubuntunscdnoble2.39-0ubuntu8.1fixed
Ubuntuglibc24.042.38-1ubuntu6vulnerable
Ubuntuglibc24.042.38-3ubuntu1vulnerable
Ubuntuglibc24.042.39-0ubuntu1vulnerable
Ubuntuglibc24.042.39-0ubuntu2vulnerable
Ubuntuglibc24.042.39-0ubuntu6vulnerable
Ubuntuglibc24.042.39-0ubuntu8vulnerable
Ubuntuglibc24.042.39-0ubuntu8.1fixed
Ubuntuglibc20.042.30-0ubuntu2vulnerable
Ubuntuglibc20.042.30-0ubuntu3vulnerable
Ubuntuglibc20.042.31-0ubuntu5vulnerable
Ubuntuglibc20.042.31-0ubuntu6vulnerable
Ubuntuglibc20.042.31-0ubuntu7vulnerable
Ubuntuglibc20.042.31-0ubuntu9vulnerable
Ubuntuglibc20.042.31-0ubuntu9.1vulnerable
Ubuntuglibc20.042.31-0ubuntu9.2vulnerable
Ubuntuglibc20.042.31-0ubuntu9.3vulnerable
Ubuntuglibc20.042.31-0ubuntu9.7vulnerable
Ubuntuglibc20.042.31-0ubuntu9.9vulnerable
Ubuntuglibc20.042.31-0ubuntu9.12vulnerable
Ubuntuglibc20.042.31-0ubuntu9.14vulnerable
Ubuntuglibc20.042.31-0ubuntu9.15fixed
Ubuntuglibc22.042.34-0ubuntu3vulnerable
Ubuntuglibc22.042.35-0ubuntu1vulnerable
Ubuntuglibc22.042.35-0ubuntu3vulnerable
Ubuntuglibc22.042.35-0ubuntu3.1vulnerable
Ubuntuglibc22.042.35-0ubuntu3.3vulnerable
Ubuntuglibc22.042.35-0ubuntu3.4vulnerable
Ubuntuglibc22.042.35-0ubuntu3.5vulnerable
Ubuntuglibc22.042.35-0ubuntu3.6vulnerable
Ubuntuglibc22.042.35-0ubuntu3.7fixed
Ubuntueglibcpro2.17-93ubuntu4vulnerable
Ubuntueglibcpro2.18-0ubuntu1vulnerable
Ubuntueglibcpro2.18-0ubuntu2vulnerable
Ubuntueglibcpro2.18-0ubuntu4vulnerable
Ubuntueglibcpro2.18-0ubuntu5vulnerable
Ubuntueglibcpro2.18-0ubuntu6vulnerable
Ubuntueglibcpro2.18-0ubuntu7vulnerable
Ubuntueglibcpro2.19-0ubuntu2vulnerable
Ubuntueglibcpro2.19-0ubuntu3vulnerable
Ubuntueglibcpro2.19-0ubuntu4vulnerable
Ubuntueglibcpro2.19-0ubuntu5vulnerable
Ubuntueglibcpro2.19-0ubuntu6vulnerable
Ubuntueglibcpro2.19-0ubuntu6.1vulnerable
Ubuntueglibcpro2.19-0ubuntu6.3vulnerable
Ubuntueglibcpro2.19-0ubuntu6.4vulnerable
Ubuntueglibcpro2.19-0ubuntu6.5vulnerable
Ubuntueglibcpro2.19-0ubuntu6.6vulnerable
Ubuntueglibcpro2.19-0ubuntu6.7vulnerable
Ubuntueglibcpro2.19-0ubuntu6.8vulnerable
Ubuntueglibcpro2.19-0ubuntu6.9vulnerable
Ubuntueglibcpro2.19-0ubuntu6.10vulnerable
Ubuntueglibcpro2.19-0ubuntu6.11vulnerable
Ubuntueglibcpro2.19-0ubuntu6.13vulnerable
Ubuntueglibcpro2.19-0ubuntu6.14vulnerable
Ubuntueglibcpro2.19-0ubuntu6.15vulnerable
Ubuntueglibcpro2.19-0ubuntu6.15+esm1vulnerable
Ubuntueglibcpro2.19-0ubuntu6.15+esm2vulnerable
Ubuntueglibcpro2.19-0ubuntu6.15+esm3fixed
Ubuntuglibcpro2.26-0ubuntu2vulnerable
Ubuntuglibcpro2.26-0ubuntu2.1vulnerable
Ubuntuglibcpro2.27-0ubuntu2vulnerable
Ubuntuglibcpro2.27-0ubuntu3vulnerable
Ubuntuglibcpro2.27-3ubuntu1vulnerable
Ubuntuglibcpro2.27-3ubuntu1.2vulnerable
Ubuntuglibcpro2.27-3ubuntu1.3vulnerable
Ubuntuglibcpro2.27-3ubuntu1.4vulnerable
Ubuntuglibcpro2.27-3ubuntu1.5vulnerable
Ubuntuglibcpro2.27-3ubuntu1.6vulnerable
Ubuntuglibcpro2.27-3ubuntu1.6+esm1vulnerable
Ubuntuglibcpro2.27-3ubuntu1.6+esm2fixed
Ubuntuglibc20.042.30-0ubuntu2vulnerable
Ubuntuglibc20.042.30-0ubuntu3vulnerable
Ubuntuglibc20.042.31-0ubuntu5vulnerable
Ubuntuglibc20.042.31-0ubuntu6vulnerable
Ubuntuglibc20.042.31-0ubuntu7vulnerable
Ubuntuglibc20.042.31-0ubuntu9vulnerable
Ubuntuglibc20.042.31-0ubuntu9.1vulnerable
Ubuntuglibc20.042.31-0ubuntu9.2vulnerable
Ubuntuglibc20.042.31-0ubuntu9.3vulnerable
Ubuntuglibc20.042.31-0ubuntu9.7vulnerable
Ubuntuglibc20.042.31-0ubuntu9.9vulnerable
Ubuntuglibc20.042.31-0ubuntu9.12vulnerable
Ubuntuglibc20.042.31-0ubuntu9.14vulnerable
Ubuntuglibc20.042.31-0ubuntu9.15fixed
Ubuntuglibc22.042.34-0ubuntu3vulnerable
Ubuntuglibc22.042.35-0ubuntu1vulnerable
Ubuntuglibc22.042.35-0ubuntu3vulnerable
Ubuntuglibc22.042.35-0ubuntu3.1vulnerable
Ubuntuglibc22.042.35-0ubuntu3.3vulnerable
Ubuntuglibc22.042.35-0ubuntu3.4vulnerable
Ubuntuglibc22.042.35-0ubuntu3.5vulnerable
Ubuntuglibc22.042.35-0ubuntu3.6vulnerable
Ubuntuglibc22.042.35-0ubuntu3.7fixed
Ubuntuglibc24.042.38-1ubuntu6vulnerable
Ubuntuglibc24.042.38-3ubuntu1vulnerable
Ubuntuglibc24.042.39-0ubuntu1vulnerable
Ubuntuglibc24.042.39-0ubuntu2vulnerable
Ubuntuglibc24.042.39-0ubuntu6vulnerable
Ubuntuglibc24.042.39-0ubuntu8vulnerable
Ubuntuglibc24.042.39-0ubuntu8.1fixed
Suseglibclinux micro 6.02.38-7.1fixed
Suseglibclinux enterprise server 11 sp4 ltss extreme core2.11.3-17.110.52.1fixed
Suseglibc-livepatcheslinux enterprise live patching 15 sp40.1-150400.3.3.1fixed
Suseglibc-livepatcheslinux enterprise live patching 15 sp50.1-150400.3.3.1fixed
Suseglibclinux enterprise high performance computing 15 sp2-ltss2.26-150000.13.73.1fixed
Suseglibclinux enterprise server 15 sp2-ltss2.26-150000.13.73.1fixed
Suseglibclinux enterprise server for sap applications 15 sp22.26-150000.13.73.1fixed
Suseglibclinux enterprise software development kit 12 sp52.22-114.34.1fixed
Suseglibclinux enterprise server 12 sp52.22-114.34.1fixed
Suseglibclinux enterprise server for sap applications 12 sp52.22-114.34.1fixed
Opensuseglibctumbleweed2.39-5.1fixed
Suseglibclinux enterprise micro 5.32.31-150300.74.1fixed
Suseglibclinux enterprise micro 5.42.31-150300.74.1fixed
Suseglibclinux enterprise micro 5.52.31-150300.74.1fixed
Suseglibclinux enterprise module for basesystem 15 sp52.31-150300.74.1fixed
Suseglibclinux enterprise module for development tools 15 sp52.31-150300.74.1fixed
Suseglibclinux enterprise high performance computing 15 sp3-ltss2.31-150300.74.1fixed
Suseglibclinux enterprise high performance computing 15 sp4-espos2.31-150300.74.1fixed
Suseglibclinux enterprise high performance computing 15 sp4-ltss2.31-150300.74.1fixed
Suseglibclinux enterprise server 15 sp3-ltss2.31-150300.74.1fixed
Suseglibclinux enterprise server 15 sp4-ltss2.31-150300.74.1fixed
Suseglibclinux enterprise server for sap applications 15 sp32.31-150300.74.1fixed
Suseglibclinux enterprise server for sap applications 15 sp42.31-150300.74.1fixed
Suseglibcmanager proxy 4.32.31-150300.74.1fixed
Suseglibcmanager server 4.32.31-150300.74.1fixed
Suseglibclinux enterprise micro 5.12.31-150300.74.1fixed
Suseglibclinux enterprise micro 5.22.31-150300.74.1fixed
Suseglibcenterprise storage 7.12.31-150300.74.1fixed
Opensuseglibcleap micro 5.32.31-150300.74.1fixed
Opensuseglibcleap micro 5.42.31-150300.74.1fixed
Opensuseglibcleap 15.52.31-150300.74.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianglibcsourcesid2.37-18not yet assignedNot reported[1069191]
Debianglibcsourceforky2.37-18not yet assignedNot reported[1069191]
Debianglibcsourcetrixie2.37-18not yet assignedNot reported[1069191]
Debianglibcsourcebookworm2.36-9+deb12u6not yet assignedNot reported[1069191]
Ubuntuglibcdebnoble2.36-9+deb12u6Not reportedNot reportedNot reported
Ubuntuglibcdebnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntuglibc-docdebnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntuglibc-sourcedebnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc-bindebnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc-dev-bindebnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc-devtoolsdebnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc6debnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc6-amd64debnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc6-devdebnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc6-dev-amd64debnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc6-dev-i386debnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc6-dev-s390debnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc6-dev-x32debnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc6-i386debnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc6-s390debnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulibc6-x32debnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulocalesdebnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntulocales-alldebnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntunscddebnoble2.39-0ubuntu8.1Not reportedNot reportedNot reported
Ubuntuglibcdeb24.042.39-0ubuntu8.1Not reportedUSN-6737-2Not reported
Ubuntuglibcdeb20.042.31-0ubuntu9.15Not reportedUSN-6737-1Not reported
Ubuntuglibcdeb22.042.35-0ubuntu3.7Not reportedUSN-6737-1Not reported
Ubuntueglibcdebpro2.19-0ubuntu6.15+esm3Not reportedUBUNTU-CVE-2024-2961Not reported
Ubuntuglibcdebpro2.27-3ubuntu1.6+esm2Not reportedUBUNTU-CVE-2024-2961Not reported
Ubuntuglibcdeb20.042.31-0ubuntu9.15Not reportedUBUNTU-CVE-2024-2961Not reported
Ubuntuglibcdeb22.042.35-0ubuntu3.7Not reportedUBUNTU-CVE-2024-2961Not reported
Ubuntuglibcdeb24.042.39-0ubuntu8.1Not reportedUBUNTU-CVE-2024-2961Not reported
Suseglibcrpmlinux micro 6.02.38-7.1Not reportedSUSE-SU-2025:20038-1Not reported
Suseglibcrpmlinux enterprise server 11 sp4 ltss extreme core2.11.3-17.110.52.1Not reportedSUSE-SU-2024:1728-1Not reported
Suseglibc-livepatchesrpmlinux enterprise live patching 15 sp40.1-150400.3.3.1Not reportedSUSE-SU-2024:1805-1Not reported
Suseglibc-livepatchesrpmlinux enterprise live patching 15 sp50.1-150400.3.3.1Not reportedSUSE-SU-2024:1805-1Not reported
Suseglibcrpmlinux enterprise high performance computing 15 sp2-ltss2.26-150000.13.73.1Not reportedSUSE-SU-2024:1977-1Not reported
Suseglibcrpmlinux enterprise server 15 sp2-ltss2.26-150000.13.73.1Not reportedSUSE-SU-2024:1977-1Not reported
Suseglibcrpmlinux enterprise server for sap applications 15 sp22.26-150000.13.73.1Not reportedSUSE-SU-2024:1977-1Not reported
Suseglibcrpmlinux enterprise software development kit 12 sp52.22-114.34.1Not reportedSUSE-SU-2024:1675-1Not reported
Suseglibcrpmlinux enterprise server 12 sp52.22-114.34.1Not reportedSUSE-SU-2024:1675-1Not reported
Suseglibcrpmlinux enterprise server for sap applications 12 sp52.22-114.34.1Not reportedSUSE-SU-2024:1675-1Not reported
Opensuseglibcrpmtumbleweed2.39-5.1Not reportedOPENSUSE-SU-2024:13877-1Not reported
Suseglibcrpmlinux enterprise micro 5.32.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise micro 5.42.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise micro 5.52.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise module for basesystem 15 sp52.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise module for development tools 15 sp52.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise high performance computing 15 sp3-ltss2.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise high performance computing 15 sp4-espos2.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise high performance computing 15 sp4-ltss2.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise server 15 sp3-ltss2.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise server 15 sp4-ltss2.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise server for sap applications 15 sp32.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise server for sap applications 15 sp42.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmmanager proxy 4.32.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmmanager server 4.32.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise micro 5.12.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmlinux enterprise micro 5.22.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Suseglibcrpmenterprise storage 7.12.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Opensuseglibcrpmleap micro 5.32.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Opensuseglibcrpmleap micro 5.42.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported
Opensuseglibcrpmleap 15.52.31-150300.74.1Not reportedSUSE-SU-2024:1375-1Not reported

[Debian bug #1069191]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References