{"id":121941,"date":"2025-02-14T20:22:09","date_gmt":"2025-02-14T18:22:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-musl-ekspluatiruemaya-pri-perekodirovanii-teksta-v-kodirovke-euc-kr"},"modified":"2025-02-14T20:22:09","modified_gmt":"2025-02-14T18:22:09","slug":"uyazvimost-v-musl-ekspluatiruemaya-pri-perekodirovanii-teksta-v-kodirovke-euc-kr","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-musl-ekspluatiruemaya-pri-perekodirovanii-teksta-v-kodirovke-euc-kr","title":{"rendered":"A vulnerability in Musl is being exploited during text transcoding into the EUC-KR encoding.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability (CVE-2024-2961) has been identified in the standard C library Musl, leading to a buffer overflow when converting specially formatted text from EUC-KR encoding to UTF-8 using the iconv() function. The vulnerability manifests starting from version musl 0.9.13 and will be fixed in the upcoming release 1.2.6 (a patch should be used until the update is published). The vulnerability was discovered by the libxml2 library during fuzz testing. <\/p>\n
The vulnerability can be used to carry out attacks on applications built with the Musl library that perform encoding of text received from external sources. Exploitation of the vulnerability is possible when the iconv_open() function is called in the application with the input encoding set to EUC-KR and the target encoding set to UTF-8. Potentially vulnerable applications include programs that convert XML, HTML, and emails based on the encoding specified in the MIME type header (for example, 'text\/plain; charset=EUC-KR'). For instance, such conversions are performed by programs using the libxml2 library. <\/p>\n
The vulnerability is caused by a combination of two errors. The first error is related to the lack of proper checks for invalid multibyte sequences in the EUC-KR decoder. The second error exists in the UTF-8 encoder, which was not designed to handle cases where the input data decoder may return invalid Unicode scalar values. As a result, processing sequences like '«81»' leads to writing values outside the allocated buffer. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"