Summary
Thijs Alkemade, Gustavo Grieco, Daniel Stenberg, and Nikos
Mavrogiannopoulos discovered that Libidn incorrectly handled invalid UTF-8
characters. A remote attacker could use this issue to cause Libidn to
crash, resulting in a denial of service, or possibly disclose sensitive
memory. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
(CVE-2015-2059)
Hanno Böck discovered that Libidn incorrectly handled certain input. A
remote attacker could possibly use this issue to cause Libidn to crash,
resulting in a denial of service. (CVE-2015-8948, CVE-2016-6262,
CVE-2016-6261, CVE-2016-6263)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | libidn | 1.28-1ubuntu2.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | libidn | 1.32-3ubuntu1.1 |
Vulnerabilities 5
-
Unscored —
The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to r…
-
Unscored —
idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byt…
-
Unscored —
The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial …
-
Unscored —
idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as…
-
Unscored —
The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to c…