Univention Bugzilla – Bug 42568
libidn: Multiple issues (3.3)
Last modified: 2019-04-11 19:23:57 CEST
+++ This bug was initially created as a clone of Bug #39441 +++ Fixed in upstream Debian package version 1.15-2+deb6u1: * The stringprep_utf8_to_ucs4 function in libidn before 1.31, as used in jabberd2 and other applications, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read (CVE-2015-2059) GNU Libidn is a fully documented implementation of the Stringprep, Punycode and IDNA specifications. Libidn's purpose is to encode and decode internationalized domain names. Possibly affects gnutls, wget, and curl +++ This bug was initially created as a clone of Bug #39440 +++
*** Bug 41949 has been marked as a duplicate of this bug. ***
Upstream Debian package version 1.25-2+deb7u2 fixes the following issues: * Solve out-of-bounds-read when reading one zero byte as input (CVE-2015-8948) * out-of-bounds stack read in idna_to_ascii_4i (CVE-2016-6261) * stringprep_utf8_nfkc_normalize reject invalid UTF-8 (CVE-2016-6263) CVE-2015-8948: CVSS v2 base score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N) CVE-2016-6261: CVSS v2 base score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N) CVE-2016-6263: CVSS v2 base score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
This issue has been filled against UCS 3.3. The maintenance with bug and security fixes for UCS 3.3 has ended on 31st of December 2016. Customers still on UCS 3.3 are encouraged to update to UCS 4.3. Please contact your partner or Univention for any questions. If this issue still occurs in newer UCS versions, please use "Clone this bug" or simply reopen the issue. In this case please provide detailed information on how this issue is affecting you.