SB2016072216 - Fedora 23 update for libidn
Published: July 22, 2016 Updated: April 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2016-6263)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
2) Out-of-bounds read (CVE-ID: CVE-2015-8948)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.
3) Out-of-bounds read (CVE-ID: CVE-2016-6262)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948.
4) Out-of-bounds read (CVE-ID: CVE-2016-6261)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.
Remediation
Install update from vendor's website.