USN-4168-1 — libidn2 vulnerabilities

Summary

It was discovered that Libidn2 incorrectly handled certain inputs.
A attacker could possibly use this issue to impersonate domains.
(CVE-2019-12290)

It was discovered that Libidn2 incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2019-18224)

Fixed packages 1

Release	Package	Fixed in
Ubuntu · 18.04 LTS 18.04:LTS	libidn2	2.0.4-1.1ubuntu0.2

Vulnerabilities 2

Unscored —

CVE-2019-12290

GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-label…

libidn2-0 libidn2 libidn2 libidn2 Debian Ubuntu Alpine

Oct 22, 2019
Unscored —

CVE-2019-18224

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

libidn2-0 libidn2 libidn2 libidn2 Debian Ubuntu Alpine

Oct 21, 2019

References

report
https://ubuntu.com/security/CVE-2019-12290
report
https://ubuntu.com/security/CVE-2019-18224

libidn2 vulnerabilities

Summary

Fixed packages 1

Vulnerabilities 2

GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-label…

idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.

References