PT-2019-1066 · Gnu+3 · Libidn2+3

Rockdaboot · Published 2019-01-07 · Updated 2020-02-01 · CVE-2019-18224

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libidn2 versions prior to 2.1.1

Description The issue is related to a heap-based buffer overflow error in the idn2 to ascii 4i() function of the GNU libidn2 library for internationalized domain names (IDN). This error can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the idn2 to ascii 4i() function in the libidn2 library until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALBA-2019:3621

ALT-PU-2019-1212

BDU:2020-01957

CVE-2019-18224

DSA-4613-1

MGASA-2019-0416

OPENSUSE-SU-2019:2611-1

OPENSUSE-SU-2019:2613-1

OPENSUSE-SU-2019_2611-1

OPENSUSE-SU-2019_2613-1

OPENSUSE-SU-2024:10950-1

SUSE-SU-2019:3086-1

USN-4168-1

Affected Products

Alt Linux

Suse

Ubuntu

Libidn2

References · 43

• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420 · Exploit
• https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c · Patch
• https://advisories.mageia.org/MGASA-2019-0416.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:2613-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MINU5RKDFE6TKAFY5DRFN3WSFDS4DYVS · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDQVQ2XPV5BTZUFINT7AFJSKNNBVURNJ · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12290 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4168-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4613-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18224 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2019-18224 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0416 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:3086-1 · Vendor Advisory
• https://usn.ubuntu.com/4168-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html · Vendor Advisory