Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Jan 2021 15:16:40 -0000 (UTC)
From: Tavis Ormandy <>
Subject: glibc iconv crash with ISO-2022-JP-3

Hello list, I suddenly got interested in mutt attack surface after
CVE-2021-3181, and some testing found a crash via charset conversion
glibc. It's just an abort(), I don't think there's any further impact.

I believe this would crash anything that does character conversion with
iconv. Mail clients do automatic charset conversion when they see a
Subject like:

    Subject: =?ISO-2022-JP-3?B?.....

or a MIME header like this:

    Content-Type: text/plain; charset=ISO-2022-JP-3

The impact is just that you can't open your mail client, because it
crashes as soon as it sees the subject.

Upstream bug:

Thanks, Tavis.

 _o)            $ lynx
 /\\  _o)  _o)  $ finger
_\_V _( ) _( )  @taviso

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.