CVE-2024-2961
published 2024-04-17CVE-2024-2961: The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the…
PriorityP180high7.3CVSS 3.1
AVLACLPRNUINSUCLILAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
88.33%
99.8th percentile
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | glibc | < glibc 2.36-9+deb12u6 (bookworm) | glibc 2.36-9+deb12u6 (bookworm) |
| eglibc | eglibc | >= 0 < 2.19-0ubuntu6.15+esm3 | 2.19-0ubuntu6.15+esm3 |
| gnu | glibc | >= 0 < 2.31-13+deb11u9 | 2.31-13+deb11u9 |
| gnu | glibc | >= 0 < 2.36-9+deb12u6 | 2.36-9+deb12u6 |
| gnu | glibc | >= 0 < 2.37-18 | 2.37-18 |
| gnu | glibc | >= 0 < 2.37-18 | 2.37-18 |
| gnu | glibc | >= 0 < 2.23-0ubuntu11.3+esm6 | 2.23-0ubuntu11.3+esm6 |
| gnu | glibc | >= 0 < 2.27-3ubuntu1.6+esm2 | 2.27-3ubuntu1.6+esm2 |
| gnu | glibc | >= 2.1.93 < 2.40 | 2.40 |
| matrix-org | matrix-sdk-crypto | >= 0.7.0 < 0.7.1 | 0.7.1 |
| the_gnu_c_library | glibc | >= 2.1.93 < 2.40 | 2.40 |
Detection & IOCsextracted from sources · hover to see the quote
pathphp://filter/read=convert.iconv.UTF-8/ISO-2022-CN-EXT/resource=/etc/passwd
- →Detect exploitation attempts by monitoring HTTP requests containing the PHP filter chain targeting ISO-2022-CN-EXT character set conversion, which is the core trigger for the iconv buffer overflow.
- →In the CosmicSting exploit chain (CVE-2024-34102 + CVE-2024-2961), attackers read /proc/self/maps to leak heap and libc addresses; monitor for XXE/LFR requests targeting this path. ↗
- →Monitor for injection of external scripts from lookalike domains (e.g. jgueurystatic[.]xyz, cdnstatics[.]net) into Magento/Adobe Commerce storefronts as indicators of post-exploitation skimmer deployment. ↗
- →The exploit constructs a long chain of PHP filters sent via the XXE vector; detect anomalously long PHP filter chains in HTTP request parameters or bodies targeting Magento REST/GraphQL endpoints. ↗
- →The overflow is triggered by SS2designation and SS3designation escape sequences during UCS4-to-ISO-2022-CN-EXT conversion; look for these byte sequences in iconv input streams. ↗
- →Nuclei template uses a GET/POST fuzzing approach replacing query parameters with the PHP filter payload and matching 'root:x:0:0' in the response body to confirm LFR/RCE.
- ·CVE-2024-2961 alone is a local buffer overflow; unauthenticated RCE requires chaining with an arbitrary file read vulnerability such as CVE-2024-34102 (CosmicSting XXE in Magento/Adobe Commerce). ↗
- ·Vulnerable PHP versions span a very wide range (7.0.0 through 8.3.7); do not assume modern PHP versions are safe without patching. ↗
- ·Disabling the ISO-2022-CN-EXT gconv module is an effective temporary mitigation but may break applications that rely on that character set conversion. ↗
- ·The overflow writes up to 4 bytes out-of-bounds; exploitation reliability depends on heap layout and libc offsets extracted at runtime from /proc/self/maps. ↗
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
osv9.8CRITICAL
vulncheck7.3HIGH
vendor_ubuntu9.8CRITICAL
vendor_oracle8.8HIGH
vendor_debian7.3HIGH
vendor_redhat7.3HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
ghsa·2024-05-13
CVE-2024-34353 [MEDIUM] CWE-532 matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
### Introduction
In Matrix, the server-side *key backup* stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assigned a unique public-private key pair.
### Impact
Due to a logic bug introduced in https://github.com/matrix-org/matrix-rust-sdk/pull/2961/commits/71136e44c03c79f80d6d1a2446673bc4d53a2067, the matrix-sdk-crypto crate version 0.7.0 will sometimes log the private part of the backup key pair to Rust debug logs (using the `tracing` crate).
### Patches
This issue has been resolved in matrix-sdk-crypto [versio
OSV
eglibc, glibc vulnerabilities
osv·2024-05-02·CVSS 9.8
CVE-2014-9984 [CRITICAL] eglibc, glibc vulnerabilities
eglibc, glibc vulnerabilities
It was discovered that GNU C Library incorrectly handled netgroup requests.
An attacker could possibly use this issue to cause a crash or execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9984)
It was discovered that GNU C Library might allow context-dependent
attackers to cause a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2015-20109)
It was discovered that GNU C Library when processing very long pathname arguments to
the realpath function, could encounter an integer overflow on 32-bit
architectures, leading to a stack-based buffer overflow and, potentially,
arbitrary code execution. This issue only affected Ubuntu 14.04 LTS.
(CVE-2018-11236)
It was discovered that the GNU C library getcwd function incorre
OSV
CVE-2024-2961: The iconv() function in the GNU C Library versions 2
osv·2024-04-17·CVSS 7.3
CVE-2024-2961 [HIGH] CVE-2024-2961: The iconv() function in the GNU C Library versions 2
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
GHSA
GHSA-22q4-f5r6-3xqw: The iconv() function in the GNU C Library versions 2
ghsa_unreviewed·2024-04-17
CVE-2024-2961 [HIGH] CWE-787 GHSA-22q4-f5r6-3xqw: The iconv() function in the GNU C Library versions 2
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
VulnCheck
GNU C Library iconv() Function Vulnerability
vulncheck·2024·CVSS 7.3
CVE-2024-2961 [HIGH] GNU C Library iconv() Function Vulnerability
GNU C Library iconv() Function Vulnerability
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
Affected: GNU GNU C Library (glibc)
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://sansec.io/research/cosmicsting; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-state-of-magecart-a-persistent-threat-to-e-commerce-security/
Exploit PoC: https://vulncheck.com/xdb/cab9ee9dc6bb; https://vulncheck.com/xdb/cb29502a8900; h
CISA ICS
Siemens SIMATIC S7-1500 CPU Family
cisa_ics·2025-06-12
Siemens SIMATIC S7-1500 CPU Family
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU Family
Release DateJune 12, 2025
Alert CodeICSA-25-162-05
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU family
- Vulnerabilities: Missing Encryption of Sensitive Data, Out-of-bounds Read, Use After Free, Stack-
Oracle
Oracle Oracle Communications Risk Matrix: Signaling (glibc) — CVE-2024-2961
vendor_oracle·2024-07-15·CVSS 8.8
CVE-2024-2961 [HIGH] Oracle Oracle Communications Risk Matrix: Signaling (glibc) — CVE-2024-2961
Oracle Oracle Communications Risk Matrix: Signaling (glibc) vulnerability
CVE: CVE-2024-2961
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2024-05-02·CVSS 9.8
CVE-2024-2961 [CRITICAL] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in GNU C Library.
It was discovered that GNU C Library incorrectly handled netgroup requests.
An attacker could possibly use this issue to cause a crash or execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9984)
It was discovered that GNU C Library might allow context-dependent
attackers to cause a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2015-20109)
It was discovered that GNU C Library when processing very long pathname arguments to
the realpath function, could encounter an integer overflow on 32-bit
architectures, leading to a stack-based buffer overflow and, potentially,
arbitrary code execution. This issue only affected Ubuntu 14.04 LTS.
(CVE-2018-11
Ubuntu
GNU C Library vulnerability
vendor_ubuntu·2024-04-29
CVE-2024-2961 GNU C Library vulnerability
Title: GNU C Library vulnerability
Summary: GNU C Library could be made to crash or run programs if it processed
specially crafted data.
USN-6737-1 fixed a vulnerability in the GNU C Library. This update provides
the corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
Charles Fol discovered that the GNU C Library iconv feature incorrectly
handled certain input sequences. An attacker could use this issue to cause
the GNU C Library to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Ubuntu
GNU C Library vulnerability
vendor_ubuntu·2024-04-18
CVE-2024-2961 GNU C Library vulnerability
Title: GNU C Library vulnerability
Summary: GNU C Library could be made to crash or run programs if it processed
specially crafted data.
Charles Fol discovered that the GNU C Library iconv feature incorrectly
handled certain input sequences. An attacker could use this issue to cause
the GNU C Library to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Red Hat
glibc: Out of bounds write in iconv may lead to remote code execution
vendor_redhat·2024-04-17·CVSS 7.3
CVE-2024-2961 [HIGH] CWE-787 glibc: Out of bounds write in iconv may lead to remote code execution
glibc: Out of bounds write in iconv may lead to remote code execution
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
An out-of-bounds write flaw was found in the ISO-2022-CN-EXT plugin for glibc's iconv library. When converting from UCS4 charset, adding certain escape charterers is required to indicate where the charset was changed to the library. During this process, iconv improperly checks the boundaries of internal buffers, leading to a buffer overflow, which allows writing up to 3 bytes outside the desired memory location. This issue may allow an attacker to craft a
Debian
CVE-2024-2961: glibc - The iconv() function in the GNU C Library versions 2.39 and older may overflow t...
vendor_debian·2024·CVSS 7.3
CVE-2024-2961 [HIGH] CVE-2024-2961: glibc - The iconv() function in the GNU C Library versions 2.39 and older may overflow t...
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
Scope: local
bookworm: resolved (fixed in 2.36-9+deb12u6)
bullseye: resolved (fixed in 2.31-13+deb11u9)
forky: resolved (fixed in 2.37-18)
sid: resolved (fixed in 2.37-18)
trixie: resolved (fixed in 2.37-18)
Suricata
ET EXPLOIT glibc iconv Abitrary File Read RCE (CVE-2024-2961)
suricata·2024-10-03·CVSS 7.3
CVE-2024-2961 [HIGH] ET EXPLOIT glibc iconv Abitrary File Read RCE (CVE-2024-2961)
ET EXPLOIT glibc iconv Abitrary File Read RCE (CVE-2024-2961)
Rule: alert http any any -> $HOME_NET any (msg:"ET EXPLOIT glibc iconv Abitrary File Read RCE (CVE-2024-2961)"; flow:established,to_server; http.method; content:"POST"; http.request_body; url_decode; content:"php|3a 2f 2f|filter|2f|read|3d|"; pcre:"/^(?:(?:convert\x2e(?:quoted-printable-(?:en|de)code|iconv(?:\x2e[a-z0-9_-]+){2}|base64-(?:de|en)code)|zlib\x2e(?:(?:in|de)flate)|string\x2e(?:(?:to(?:upp|low)er)|rot13|strip_tags)|dechunk|consumed)(?:\x7c|\x2f)?)+/R"; content:"|2e|ISO-2022-CN-EXT|7c|"; fast_pattern; content:"|2f|resource|3d|"; distance:0; reference:url,www.ambionics.io/blog/iconv-cve-2024-2961-p1; reference:cve,2024-2961; classtype:web-application-attack; sid:2056446; rev:1; metadata:attack_target Server, tls_state
Nuclei
PHP - LFR to Remote Code Execution
nuclei·CVSS 7.3
CVE-2024-2961 [HIGH] PHP - LFR to Remote Code Execution
PHP - LFR to Remote Code Execution
PHP Local File Read vulnerability leading to Remote Code Execution
Template:
id: CVE-2024-2961
info:
name: PHP - LFR to Remote Code Execution
author: Kim Dongyoung (Kairos-hk),bolkv,n0ming,RoughBoy0723
severity: high
description: |
PHP Local File Read vulnerability leading to Remote Code Execution
impact: |
Remote attackers can execute arbitrary code on the server
remediation: |
Update PHP to the latest version and sanitize user input to prevent LFR attacks
reference:
- https://github.com/vulhub/vulhub/tree/master/php/CVE-2024-2961
- https://nvd.nist.gov/vuln/detail/CVE-2024-2961
classification:
cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
cvss-score: 7.3
cve-id: CVE-2024-2961
cwe-id: CWE-787
epss-score: 0.92156
epss-percentile: 0.99711
Metasploit
CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)
metasploit·CVSS 7.3
CVE-2024-34102 [HIGH] CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)
CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)
This combination of an Arbitrary File Read (CVE-2024-34102) and a Buffer Overflow in glibc (CVE-2024-2961) allows for unauthenticated Remote Code Execution on the following versions of Magento and Adobe Commerce and earlier if the PHP and glibc versions are also vulnerable: - 2.4.7 and earlier - 2.4.6-p5 and earlier - 2.4.5-p7 and earlier - 2.4.4-p8 and earlier Vulnerable PHP versions: - From PHP 7.0.0 (2015) to 8.3.7 (2024) Vulnerable iconv() function in the GNU C Library: - 2.39 and earlier The exploit chain is quite interesting and for more detailed information check out the references. The tl;dr being: CVE-2024-34102 is an XML External Entity vulnerability l
Bleepingcomputer
Over 4,000 Adobe Commerce, Magento shops hacked in CosmicSting attacks
blogs_bleepingcomputer·2024-10-03·CVSS 7.3
CVE-2024-34102 [HIGH] Over 4,000 Adobe Commerce, Magento shops hacked in CosmicSting attacks
## Over 4,000 Adobe Commerce, Magento shops hacked in CosmicSting attacks
## Bill Toulas
Adobe Commerce and Magento online stores are being targeted in "CosmicSting" attacks at an alarming rate, with threat actors hacking approximately 5% of all stores.
The CosmicSting vulnerability (CVE-2024-34102) is a critical severity information disclosure flaw; when chained with CVE-2024-2961, a security issue in glibc's iconv function, an attacker can achieve remote code execution on the target server.
The critical flaw impacts the following products:
Adobe Commerce 2.4.7 and earlier, including 2.4.6-p5, 2.4.5-p7, 2.4.4-p8
Adobe Commerce Extended Support 2.4.3-ext-7 and earlier, 2.4.2-ext-7 and earlier, 2.4.1-ext-7 and earlier, 2.4.0-ext-7 and earlier, 2.3.7-p4-ext-7 and earlier.
Magento Open
Bugzilla
CVE-2024-2961 glibc: Out of bounds write in iconv may lead to remote code execution
bugzilla·2024-04-04·CVSS 7.3
CVE-2024-2961 [HIGH] CVE-2024-2961 glibc: Out of bounds write in iconv may lead to remote code execution
CVE-2024-2961 glibc: Out of bounds write in iconv may lead to remote code execution
The iconv plugin ISO-2022-CN-EXT, when converting from UCS4, might trigger a OOB write. The encoding requires to add escape sequence to indicate where
it changes the character set (as described by RFC 1922) and while the bounds check is done by the SOdesignation designation, it is missing for SS2designation and SS3designation. This leads to an overflow of 1, 2, or 3 bytes with fixed values: `$+I`, `$+J`, `$+K`, `$+L`, `$+M`, or , `$*H`.
Discussion:
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 2275855]
---
Created glibc tracking bugs for this issue:
Affects: fedora-rawhide [bug 2275933]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
arXiv
Advancing LLM-Based Security Automation with Customized Group Relative Policy Optimization for Zero-Touch Networks
arxiv_fulltext·2025-12-10
Advancing LLM-Based Security Automation with Customized Group Relative Policy Optimization for Zero-Touch Networks
Advancing LLM-Based Security Automation with Customized Group Relative Policy Optimization for Zero-Touch Networks
Xinye Cao, Graduate Student Member, IEEE, Yihan Lin, Guoshun Nan, Member, IEEE, Qinchuan Zhou,
Yuhang Luo, Yurui Gao, Zeliang Zhang, Haolang Lu, Qimei Cui, Senior Member, IEEE, \ Hou, Member, IEEE, Xiaofeng Tao, Senior Member, IEEE, Tony Q.S. Quek, Fellow, IEEE
This work was supported in part by the National Natural Science Foundation of China under Grant 62471064; in part by the National Research Foundation, Singapore and Infocomm Media Development Authority under its Communications and Connectivity Bridging Funding Initiative; in part by the Beijing Natural Science Foundation Program (No.L232002); in part by Beijing University of Posts and Telecommunications (BUPT) Excellen
http://www.openwall.com/lists/oss-security/2024/04/17/9http://www.openwall.com/lists/oss-security/2024/04/18/4http://www.openwall.com/lists/oss-security/2024/04/24/2http://www.openwall.com/lists/oss-security/2024/05/27/1http://www.openwall.com/lists/oss-security/2024/05/27/2http://www.openwall.com/lists/oss-security/2024/05/27/3http://www.openwall.com/lists/oss-security/2024/05/27/4http://www.openwall.com/lists/oss-security/2024/05/27/5http://www.openwall.com/lists/oss-security/2024/05/27/6http://www.openwall.com/lists/oss-security/2024/07/22/5https://lists.debian.org/debian-lts-announce/2024/05/msg00001.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/https://lists.fedoraproject.org/archives/list/[email protected]/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/https://lists.fedoraproject.org/archives/list/[email protected]/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/https://security.netapp.com/advisory/ntap-20240531-0002/https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004http://www.openwall.com/lists/oss-security/2024/04/17/9http://www.openwall.com/lists/oss-security/2024/04/18/4http://www.openwall.com/lists/oss-security/2024/04/24/2http://www.openwall.com/lists/oss-security/2024/05/27/1http://www.openwall.com/lists/oss-security/2024/05/27/2http://www.openwall.com/lists/oss-security/2024/05/27/3http://www.openwall.com/lists/oss-security/2024/05/27/4http://www.openwall.com/lists/oss-security/2024/05/27/5http://www.openwall.com/lists/oss-security/2024/05/27/6http://www.openwall.com/lists/oss-security/2024/07/22/5https://lists.debian.org/debian-lts-announce/2024/05/msg00001.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/https://lists.fedoraproject.org/archives/list/[email protected]/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/https://lists.fedoraproject.org/archives/list/[email protected]/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/https://security.netapp.com/advisory/ntap-20240531-0002/https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004https://www.ambionics.io/blog/iconv-cve-2024-2961-p1https://www.ambionics.io/blog/iconv-cve-2024-2961-p2https://www.ambionics.io/blog/iconv-cve-2024-2961-p3https://cert-portal.siemens.com/productcert/html/ssa-082556.html
2024-04-17
Published
Exploited in the wild