According to the versions of the libidn package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - idn in libidn before 1.33 might allow remote attackers     to obtain sensitive memory information by reading a     zero byte as input, which triggers an out-of-bounds     read, a different vulnerability than     CVE-2015-8948.(CVE-2016-6262)

  - idn in GNU libidn before 1.33 might allow remote     attackers to obtain sensitive memory information by     reading a zero byte as input, which triggers an     out-of-bounds read.(CVE-2015-8948)

  - The stringprep_utf8_nfkc_normalize function in     lib/nfkc.c in libidn before 1.33 allows     context-dependent attackers to cause a denial of     service (out-of-bounds read and crash) via crafted     UTF-8 data.(CVE-2016-6263)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in libidn. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2015-8948

When idn is reading one zero byte as input an out-of-bounds-read occurred.

CVE-2016-6261

An out-of-bounds stack read is exploitable in idna_to_ascii_4i.

CVE-2016-6263

stringprep_utf8_nfkc_normalize reject invalid UTF-8, causes a crash.

For Debian 7 'Wheezy', these problems have been fixed in version 1.25-2+deb7u2.

We recommend that you upgrade your libidn packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-6263, CVE-2015-8948, CVE-2016-6262, CVE-2016-6261

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libidn package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - idn in GNU libidn before 1.33 might allow remote     attackers to obtain sensitive memory information by     reading a zero byte as input, which triggers an     out-of-bounds read.(CVE-2015-8948)

  - The idna_to_ascii_4i function in lib/idna.c in libidn     before 1.33 allows context-dependent attackers to cause     a denial of service (out-of-bounds read and crash) via     64 bytes of input.(CVE-2016-6261)

  - idn in libidn before 1.33 might allow remote attackers     to obtain sensitive memory information by reading a     zero byte as input, which triggers an out-of-bounds     read, a different vulnerability than     CVE-2015-8948.(CVE-2016-6262)

  - The stringprep_utf8_nfkc_normalize function in     lib/nfkc.c in libidn before 1.33 allows     context-dependent attackers to cause a denial of     service (out-of-bounds read and crash) via crafted     UTF-8 data.(CVE-2016-6263)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libidn packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

Simon Josefsson reports :

libidn: Fix out-of-bounds stack read in idna_to_ascii_4i.

idn: Solve out-of-bounds-read when reading one zero byte as input.
Also replaced fgets with getline.

libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was always documented to only accept UTF-8 data, but now it doesn't crash when presented with such data.

This update for libidn fixes the following issues :

  - CVE-2016-6262 and CVE-2015-8948: Out-of-bounds-read when     reading one zero byte as input (bsc#990189)

  - CVE-2016-6261: Out-of-bounds stack read in     idna_to_ascii_4i (bsc#990190)

  - CVE-2016-6263: stringprep_utf8_nfkc_normalize reject     invalid UTF-8 (bsc#990191)

  - CVE-2015-2059: out-of-bounds read with stringprep on     invalid UTF-8 (bsc#923241)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
131884	EulerOS 2.0 SP2 : libidn (EulerOS-SA-2019-2392)	Nessus	Huawei Local Security Checks	2019/12/10	2024/4/4	high
92683	Debian DLA-582-1 : libidn security update	Nessus	Debian Local Security Checks	2016/8/3	2026/1/29	high
92800	Fedora 23 : libidn (2016-610fe5f5f8)	Nessus	Fedora Local Security Checks	2016/8/9	2026/1/29	high
134554	EulerOS Virtualization for ARM 64 3.0.2.0 : libidn (EulerOS-SA-2020-1265)	Nessus	Huawei Local Security Checks	2020/3/13	2024/3/22	high
92529	Fedora 24 : libidn (2016-42514bee97)	Nessus	Fedora Local Security Checks	2016/7/25	2026/1/30	high
92607	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : libidn (SSA:2016-210-01)	Nessus	Slackware Local Security Checks	2016/7/29	2026/1/30	high
92652	FreeBSD : libidn -- multiple vulnerabilities (cb5189eb-572f-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	2016/8/1	2026/1/29	high
93459	SUSE SLES11 Security Update : libidn (SUSE-SU-2016:2291-1)	Nessus	SuSE Local Security Checks	2016/9/13	2026/1/26	high

检测

插件搜索

high

high

high

high

high

high

high

high