CVE-2016-6261
HighSummary
The idna_to_ascii_4i function in lib/idna.c in libidn before version 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.
Risk Assessment
An attacker can exploit this vulnerability to crash the application, potentially leading to service downtime.
Recommendation
It is recommended to update libidn to version 1.33 or later to mitigate this vulnerability.
Other vulnerabilities in libidn
See all- CVE-2016-6263High
The stringprep_utf8_nfkc_normalize function in libidn before version 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
- CVE-2016-6262High
In libidn before version 1.33, a vulnerability may allow remote attackers to obtain sensitive memory information by reading a zero byte as input, triggering an out-of-bounds read.
Original NVD description (English source)
The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.