CVE-2016-6261

Опубликовано: 07 сент. 2016

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.

Ссылки

http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=f20ce1128fb7f4d33297eee307dddaf0f92ac72d
Issue Tracking
Patch
http://lists.opensuse.org/opensuse-updates/2016-08/msg00098.html
Third Party Advisory
http://www.debian.org/security/2016/dsa-3658
http://www.openwall.com/lists/oss-security/2016/07/20/6
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/07/21/4
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/92070
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-3068-1
Third Party Advisory
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
https://lists.gnu.org/archive/html/help-libidn/2015-07/msg00016.html
Mailing List
Vendor Advisory
https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html
Vendor Advisory
http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=f20ce1128fb7f4d33297eee307dddaf0f92ac72d
Issue Tracking
Patch
http://lists.opensuse.org/opensuse-updates/2016-08/msg00098.html
Third Party Advisory
http://www.debian.org/security/2016/dsa-3658
http://www.openwall.com/lists/oss-security/2016/07/20/6
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/07/21/4
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/92070
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-3068-1
Third Party Advisory
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:gnu:libidn:*:*:*:*:*:*:*:*

Версия до 1.32 (включая)

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

EPSS

Процентиль: 91%

0.04369

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2016-6261

CVSS3: 7.5

ubuntu

около 10 лет назад

The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.

CVE-2016-6261

CVSS3: 3.7

redhat

больше 10 лет назад

The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.

CVE-2016-6261

CVSS3: 7.5

debian

около 10 лет назад

The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allo ...

GHSA-hr7q-x7xm-q959

CVSS3: 7.5

github

больше 4 лет назад

The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.

ALT-PU-2018-1106

CVSS3: 9.8

altlinux

почти 9 лет назад

ALT-PU-2018-1106: package `glibc` update to version 2.26.9000.0.1248.407552c-alt1

EPSS

Процентиль: 91%

0.04369

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-125