CVE-2015-8948

High

Published: 07/09/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In GNU libidn before version 1.33, a vulnerability exists that may allow remote attackers to obtain sensitive memory information by reading a zero byte as input, triggering an out-of-bounds read.

Risk Assessment

Attackers may gain access to sensitive data, potentially leading to further attacks on the system or the disclosure of confidential information.

Recommendation

It is recommended to update GNU libidn to version 1.33 or later to mitigate this vulnerability.

Other vulnerabilities in GNU libidn

CVE-2026-57053Medium
GNU libidn before version 1.44 is vulnerable to out-of-bounds reads of uninitialized memory in the ToUnicode APIs due to mishandling in the idna_to_unicode_internal function. The vulnerable code is not present in libidn2.

Original NVD description (English source)

idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.