Univention Bugzilla – Bug 39441
libidn: Multiple issues (3.2)
Last modified: 2019-04-11 19:24:58 CEST
Fixed in upstream Debian package version 1.15-2+deb6u1: * The stringprep_utf8_to_ucs4 function in libidn before 1.31, as used in jabberd2 and other applications, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read (CVE-2015-2059) GNU Libidn is a fully documented implementation of the Stringprep, Punycode and IDNA specifications. Libidn's purpose is to encode and decode internationalized domain names. Possibly affects gnutls, wget, and curl +++ This bug was initially created as a clone of Bug #39440 +++
*** Bug 41950 has been marked as a duplicate of this bug. ***
This issue has been filed against UCS 3. UCS 3 is out of the normal maintenance and many UCS components have vastly changed in UCS 4. If this issue is still valid, please change the version to a newer UCS version otherwise this issue will be automatically closed in the next weeks.
This issue has been filed against UCS 3.2. UCS 3.2 is out of maintenance and many UCS components have vastly changed in later releases. Thus, this issue is now being closed. If this issue still occurs in newer UCS versions, please use "Clone this bug" or reopen this issue. In this case please provide detailed information on how this issue is affecting you.