Security Update for libidn
Summary
DLA-582-1: libidn - security update. Affects libidn versions < 1.25-2+deb7u2. Fixed in 1.25-2+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libidn is a library used for Internationalized Domain Names (IDNs) handling. It provides functions for converting domain names between their ASCII and Unicode representations. This vulnerability affects libidn version 1.25-2+deb7u2 and earlier.
Vulnerability Detail
Multiple vulnerabilities have been discovered in libidn:
- CVE-2015-8948: When idn is reading one zero byte as input, an out-of-bounds-read occurred.
- CVE-2016-6261: An out-of-bounds stack read is exploitable in idna_to_ascii_4i.
- CVE-2016-6263: stringprep_utf8_nfkc_normalize rejects invalid UTF-8, causing a crash.
These vulnerabilities can lead to various security issues, including information disclosure and denial of service attacks.
How To Fix
Minimum fixed version
1.25-2+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libidnTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
Upgrading to libidn version 1.25-2+deb7u2 or later is crucial to mitigate the security risks associated with these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libidn →
FAQ
libidn is a library used for Internationalized Domain Names (IDNs) handling. It provides functions for converting domain names between their ASCII and Unicode representations.
An out-of-bounds-read vulnerability occurs when a program reads data from a memory location outside of the boundaries of a buffer or array. This can lead to information disclosure or crashes.
CVE-2015-8948 is a vulnerability in libidn where an out-of-bounds-read occurs when reading one zero byte as input.
CVE-2016-6261 is a vulnerability in libidn where an out-of-bounds stack read is exploitable in idna_to_ascii_4i.
CVE-2016-6263 is a vulnerability in libidn where stringprep_utf8_nfkc_normalize rejects invalid UTF-8, causing a crash.
Related vulnerabilities
Recent vulnerabilities recorded for libidn.
