This libidn update to version 1.33 fixes the following issues :

Security issues fixed :

  - CVE-2015-8948, CVE-2016-6262: Fixed an     out-of-bounds-read when reading one zero byte as input     (bsc#990189).

  - CVE-2016-6263: Fixed stringprep_utf8_nfkc_normalize to     reject invalid UTF-8 (bsc#boo#990191).

Included bugfixes :

  - Fixed crash in idna_to_unicode_8z8z and     idna_to_unicode_8zlz (introduced in 1.31).

  - API and ABI is backwards compatible with the previous     version.

  - Update gpg keyring

This update for libidn fixes the following issues :

  - CVE-2016-6262 and CVE-2015-8948: Out-of-bounds-read when     reading one zero byte as input (bsc#990189)

  - CVE-2016-6261: Out-of-bounds stack read in     idna_to_ascii_4i (bsc#990190) 

  - CVE-2016-6263: stringprep_utf8_nfkc_normalize reject     invalid UTF-8 (bsc#990191)

  - CVE-2015-2059: out-of-bounds read with stringprep on     invalid UTF-8 (bsc#923241) 

This update was imported from the SUSE:SLE-12:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by     reading a zero byte as input, which triggers an out-of-bounds read. (CVE-2015-8948)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the libidn package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - idn in GNU libidn before 1.33 might allow remote     attackers to obtain sensitive memory information by     reading a zero byte as input, which triggers an     out-of-bounds read.(CVE-2015-8948)

  - The idna_to_ascii_4i function in lib/idna.c in libidn     before 1.33 allows context-dependent attackers to cause     a denial of service (out-of-bounds read and crash) via     64 bytes of input.(CVE-2016-6261)

  - idn in libidn before 1.33 might allow remote attackers     to obtain sensitive memory information by reading a     zero byte as input, which triggers an out-of-bounds     read, a different vulnerability than     CVE-2015-8948.(CVE-2016-6262)

  - The stringprep_utf8_nfkc_normalize function in     lib/nfkc.c in libidn before 1.33 allows     context-dependent attackers to cause a denial of     service (out-of-bounds read and crash) via crafted     UTF-8 data.(CVE-2016-6263)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libidn packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

Simon Josefsson reports :

libidn: Fix out-of-bounds stack read in idna_to_ascii_4i.

idn: Solve out-of-bounds-read when reading one zero byte as input.
Also replaced fgets with getline.

libidn: stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was always documented to only accept UTF-8 data, but now it doesn't crash when presented with such data.

Security fix for CVE-2016-6263, CVE-2015-8948, CVE-2016-6262, CVE-2016-6261

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libidn fixes the following issues :

  - CVE-2016-6262 and CVE-2015-8948: Out-of-bounds-read when     reading one zero byte as input (bsc#990189)

  - CVE-2016-6261: Out-of-bounds stack read in     idna_to_ascii_4i (bsc#990190)

  - CVE-2016-6263: stringprep_utf8_nfkc_normalize reject     invalid UTF-8 (bsc#990191)

  - CVE-2015-2059: out-of-bounds read with stringprep on     invalid UTF-8 (bsc#923241)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
92743	openSUSE Security Update : libidn (openSUSE-2016-925)	Nessus	SuSE Local Security Checks	8/5/2016	1/29/2026	high
93092	openSUSE Security Update : libidn (openSUSE-2016-1014)	Nessus	SuSE Local Security Checks	8/24/2016	1/28/2026	high
219212	Linux Distros Unpatched Vulnerability : CVE-2015-8948	Nessus	Misc.	3/4/2025	9/2/2026	high
134554	EulerOS Virtualization for ARM 64 3.0.2.0 : libidn (EulerOS-SA-2020-1265)	Nessus	Huawei Local Security Checks	3/13/2020	3/22/2024	high
92607	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : libidn (SSA:2016-210-01)	Nessus	Slackware Local Security Checks	7/29/2016	1/30/2026	high
92652	FreeBSD : libidn -- multiple vulnerabilities (cb5189eb-572f-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	8/1/2016	1/29/2026	high
92529	Fedora 24 : libidn (2016-42514bee97)	Nessus	Fedora Local Security Checks	7/25/2016	1/30/2026	high
93459	SUSE SLES11 Security Update : libidn (SUSE-SU-2016:2291-1)	Nessus	SuSE Local Security Checks	9/13/2016	1/26/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high