此 libidn 更新可修复下列问题：

- CVE-2016-6262 与 CVE-2015-8948：将一个零字节读取为输入时的越界读取 (bsc#990189)

- CVE-2016-6261：idna_to_ascii_4i 中的越界堆栈读取 (bsc#990190)

- CVE-2016-6263：stringprep_utf8_nfkc_normalize 拒绝无效的 UTF-8 (bsc#990191)

- CVE-2015-2059：在无效的 UTF-8 上使用 stringprep 时发生越界读取 (bsc#923241)

此更新从 SUSE:SLE-12:Update 更新项目导入。

此 libidn 更新可修复下列问题：

- CVE-2016-6262 与 CVE-2015-8948：将一个零字节读取为输入时的越界读取 (bsc#990189)

- CVE-2016-6261：idna_to_ascii_4i 中的越界堆栈读取 (bsc#990190)

- CVE-2016-6263：stringprep_utf8_nfkc_normalize 拒绝无效的 UTF-8 (bsc#990191)

- CVE-2015-2059：在无效的 UTF-8 上使用 stringprep 时发生越界读取 (bsc#923241)

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

According to the versions of the libidn package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - idn in GNU libidn before 1.33 might allow remote     attackers to obtain sensitive memory information by     reading a zero byte as input, which triggers an     out-of-bounds read.(CVE-2015-8948)

  - The idna_to_ascii_4i function in lib/idna.c in libidn     before 1.33 allows context-dependent attackers to cause     a denial of service (out-of-bounds read and crash) via     64 bytes of input.(CVE-2016-6261)

  - idn in libidn before 1.33 might allow remote attackers     to obtain sensitive memory information by reading a     zero byte as input, which triggers an out-of-bounds     read, a different vulnerability than     CVE-2015-8948.(CVE-2016-6262)

  - The stringprep_utf8_nfkc_normalize function in     lib/nfkc.c in libidn before 1.33 allows     context-dependent attackers to cause a denial of     service (out-of-bounds read and crash) via crafted     UTF-8 data.(CVE-2016-6263)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libidn package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The idna_to_ascii_4i function in lib/idna.c in libidn     before 1.33 allows context-dependent attackers to cause     a denial of service (out-of-bounds read and crash) via     64 bytes of input.(CVE-2016-6261)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Simon Josefsson reports :

libidn: Fix out-of-bounds stack read in idna_to_ascii_4i.

idn: Solve out-of-bounds-read when reading one zero byte as input.
Also replaced fgets with getline.

libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was always documented to only accept UTF-8 data, but now it doesn't crash when presented with such data.

Security fix for CVE-2016-6263, CVE-2015-8948, CVE-2016-6262, CVE-2016-6261

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Plugin has been deprecated due to a change in logic. Coverage will be provided in a new plugin.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
93092	openSUSE 安全更新：libidn (openSUSE-2016-1014)	Nessus	SuSE Local Security Checks	2016/8/24	2021/1/19	high
93459	SUSE SLES11 安全更新：libidn (SUSE-SU-2016:2291-1)	Nessus	SuSE Local Security Checks	2016/9/13	2021/1/19	high
134554	EulerOS Virtualization for ARM 64 3.0.2.0 : libidn (EulerOS-SA-2020-1265)	Nessus	Huawei Local Security Checks	2020/3/13	2024/3/22	high
128903	EulerOS 2.0 SP2 : libidn (EulerOS-SA-2019-1851)	Nessus	Huawei Local Security Checks	2019/9/17	2024/4/25	high
92652	FreeBSD : libidn -- multiple vulnerabilities (cb5189eb-572f-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	2016/8/1	2021/1/4	high
92529	Fedora 24 : libidn (2016-42514bee97)	Nessus	Fedora Local Security Checks	2016/7/25	2021/1/11	high
198578	RHEL 6 : libidn (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	2024/6/3	2025/2/18	critical

检测

插件搜索

high

high

high

high

high

high

critical