PT-2019-1066 · Gnu+3 · Libidn2+3

Rockdaboot · Publicado 2019-01-07 · Atualizado 2020-02-01 · CVE-2019-18224

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libidn2 versions prior to 2.1.1

Description The issue is related to a heap-based buffer overflow error in the idn2 to ascii 4i() function of the GNU libidn2 library for internationalized domain names (IDN). This error can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the idn2 to ascii 4i() function in the libidn2 library until a patch is available.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

ALBA-2019:3621

ALT-PU-2019-1212

BDU:2020-01957

CVE-2019-18224

DSA-4613-1

MGASA-2019-0416

OPENSUSE-SU-2019:2611-1

OPENSUSE-SU-2019:2613-1

OPENSUSE-SU-2019_2611-1

OPENSUSE-SU-2019_2613-1

OPENSUSE-SU-2024:10950-1

SUSE-SU-2019:3086-1

USN-4168-1

Produtos afetados

Alt Linux

Suse

Ubuntu

Libidn2

Referências · 43

• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420 · Exploit
• https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c · Correção
• https://github.com/libidn/libidn2/compare/libidn2-2.1.0...libidn2-2.1.1 · Nota
• https://suse.com/security/cve/CVE-2019-18224 · Nota
• https://advisories.mageia.org/MGASA-2019-0416.html · Nota de Segurança
• https://bugzilla.suse.com/1154887 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2019:2613-1 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=25652 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MINU5RKDFE6TKAFY5DRFN3WSFDS4DYVS · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2019-18224 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDQVQ2XPV5BTZUFINT7AFJSKNNBVURNJ · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-12290 · Aviso do Fabricante
• https://lists.opensuse.org/archives/list/[e-mail]/thread/X7ZUBC27FFSQ6NLYE4F6HZ22CMNU2UJV/#X7ZUBC27FFSQ6NLYE4F6HZ22CMNU2UJV · Nota
• https://osv.dev/vulnerability/USN-4168-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4613-1 · Aviso do Fabricante