Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Summary: Non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state <br/> handling (`iconvdata/shift_jisx0213.c`): crafted input can cause repeated <br/> emission of a buffered code point without further input consumption, <br/> leading to persistent retry churn and denial of service in callers <br/> converting untrusted text.<br/> Requirements to exploit: An attacker must be able to supply text that an <br/> application converts from `SHIFT_JISX0213` to `UCS-4`, trigger a 2-byte <br/> sequence that expands through `__jisx0213_to_ucs_combining`, and have the <br/> caller retry after `E2BIG` with the same conversion state once only enough <br/> output space remains for the first of the two emitted code points. <br/> Applications that never use this conversion path, or that abort on repeated <br/> no-progress `E2BIG`, are not practically exposed.<br/> Component affected: `glibc-2.42-11.1.hum1`; `iconvdata/shift_jisx0213.c`, <br/> `from_shift_jisx0213` (`BODY` macro) in the `SHIFT_JISX0213` -> `UCS-4` <br/> conversion path.<br/>
Zig is not affected by this vulnerability. While `zig.spec` declares `Provides: bundled(glibc) = 2.43` to account for embedded headers and ABI symbol metadata, Zig does not bundle or compile the GNU C Library implementation of the affected routine. Specifically: - Zig only ships glibc ABI symbol tables (`abilists`) to generate compile-time dynamic linking stubs (`.so`), generic headers, and minimal C runtime startup objects (`crt1.o`, `elf-init`, `stat` shims). - Zig compiler binaries and generated executables dynamically link against the host/target system's runtime `libc.so.6`. Closing as NOTABUG.