Multiple vulnerabilities have been discovered in libidn. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2015-8948

When idn is reading one zero byte as input an out-of-bounds-read occurred.

CVE-2016-6261

An out-of-bounds stack read is exploitable in idna_to_ascii_4i.

CVE-2016-6263

stringprep_utf8_nfkc_normalize reject invalid UTF-8, causes a crash.

For Debian 7 'Wheezy', these problems have been fixed in version 1.25-2+deb7u2.

We recommend that you upgrade your libidn packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libidn fixes the following issues :

  - CVE-2016-6262 and CVE-2015-8948: Out-of-bounds-read when     reading one zero byte as input (bsc#990189)

  - CVE-2016-6261: Out-of-bounds stack read in     idna_to_ascii_4i (bsc#990190)

  - CVE-2016-6263: stringprep_utf8_nfkc_normalize reject     invalid UTF-8 (bsc#990191)

  - CVE-2015-2059: out-of-bounds read with stringprep on     invalid UTF-8 (bsc#923241)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.33 (#1374902,#1359147,#1359148)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by     reading a zero byte as input, which triggers an out-of-bounds read. (CVE-2015-8948)

Note that Nessus relies on the presence of the package as reported by the vendor.

現已提供適用於 Slackware 13.0、13.1、13.37、14.0、14.1、14.2 和最新版本的新 libidn 套件，可修正多個安全性問題。

在 libidn 中發現多個弱點。Common Vulnerabilities and Exposures 專案發現下列問題：

CVE-2015-8948

當 idn 讀取一個零位元組做為輸入時，會發生超出邊界讀取。

CVE-2016-6261

idna_to_ascii_4i 中存在一個可能遭惡意利用的超出邊界堆疊讀取。

CVE-2016-6263

Stringprep_utf8_nfkc_normalize 拒絕無效的 UTF-8，造成當機。

針對 Debian 7「Wheezy」，這些問題已在 1.25-2+deb7u2 版本中修正。

建議您升級 libidn 套件。

注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

此 libidn 更新可修正下列問題：

- CVE-2016-6262 與 CVE-2015-8948：將一個零位元組讀取為輸入時的超出邊界讀取問題 (bsc#990189)

- CVE-2016-6261：idna_to_ascii_4i 中的超出邊界堆疊讀取問題 (bsc#990190)

- CVE-2016-6263：stringprep_utf8_nfkc_normalize 拒絕無效的 UTF-8 (bsc#990191)

- CVE-2015-2059：無效 UTF-8 的 stringprep 超出邊界讀取問題 (bsc#923241)

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 1.33 之前版本的 GNU libidn 中，idn 可能允許遠端攻擊者讀取零位元組作為輸入，進而觸發超出邊界讀取，藉此取得敏感記憶體資訊。 (CVE-2015-8948)

請注意，Nessus 依賴供應商報告的套件存在。

ID	名稱	產品	系列	已發布	已更新	嚴重性
92683	Debian DLA-582-1 : libidn security update	Nessus	Debian Local Security Checks	2016/8/3	2021/1/11	high
93292	SUSE SLED12 / SLES12 Security Update : libidn (SUSE-SU-2016:2079-1)	Nessus	SuSE Local Security Checks	2016/9/2	2021/1/6	high
94888	Fedora 25 : mingw-libidn (2016-f99c0a8b69)	Nessus	Fedora Local Security Checks	2016/11/15	2021/1/11	high
219212	Linux Distros Unpatched Vulnerability : CVE-2015-8948	Nessus	Misc.	2025/3/4	2025/9/4	high
92607	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / 最新版本：libidn (SSA:2016-210-01)	Nessus	Slackware Local Security Checks	2016/7/29	2021/1/14	high
92683	Debian DLA-582-1：libidn 安全性更新	Nessus	Debian Local Security Checks	2016/8/3	2021/1/11	high
93292	SUSE SLED12 / SLES12 安全性更新：libidn (SUSE-SU-2016:2079-1)	Nessus	SuSE Local Security Checks	2016/9/2	2021/1/6	high
219212	Linux Distros 未修補弱點：CVE-2015-8948	Nessus	Misc.	2025/3/4	2025/9/4	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high