CVE-2012-6656

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of "0xffff" to the iconv function when converting IBM930 encoded data to UTF-8.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2015/dsa-3142Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2014:175Broken Link
http://www.openwall.com/lists/oss-security/2014/08/29/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/09/02/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/69472Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2432-1Third Party Advisory
https://security.gentoo.org/glsa/201503-04
https://sourceware.org/bugzilla/show_bug.cgi?id=14134Exploit, Issue Tracking
https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=6e230d11837f3ae7b375ea69d7905f0d18eb79e5
http://www.debian.org/security/2015/dsa-3142Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2014:175Broken Link
http://www.openwall.com/lists/oss-security/2014/08/29/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/09/02/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/69472Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2432-1Third Party Advisory
https://security.gentoo.org/glsa/201503-04
https://sourceware.org/bugzilla/show_bug.cgi?id=14134Exploit, Issue Tracking
https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=6e230d11837f3ae7b375ea69d7905f0d18eb79e5

Timeline

Published: Dec 5, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-66574.9The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5.7 does not ensure that a keepalive action is associated with CVE-2012-66584.3Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML vi CVE-2012-66594.3Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web scri CVE-2012-666010.0GE Healthcare Precision MPi has a password of (1) orion for the serviceapp user, (2) orion for the clinical operator user, and (3) PlatinumO CVE-2012-66615.0Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which m CVE-2012-66624.3Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.1 CVE-2012-66637.5General Electric D20ME devices are not properly configured and reveal plaintext passwords.CVE-2012-66649.1Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read CVE-2012-66654.3Directory traversal vulnerability in index.php in phpMoneyBooks 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in CVE-2012-66666.1vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.CVE-2012-66676.1Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows remote attackers to i CVE-2012-66686.1Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBul