CVE-2016-6262
HighSummary
In libidn before version 1.33, a vulnerability may allow remote attackers to obtain sensitive memory information by reading a zero byte as input, triggering an out-of-bounds read.
Risk Assessment
This vulnerability could lead to the disclosure of sensitive data in memory, posing a significant security risk to the system.
Recommendation
It is recommended to update the libidn library to version 1.33 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in libidn
See all- CVE-2016-6263High
The stringprep_utf8_nfkc_normalize function in libidn before version 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
- CVE-2016-6261High
The idna_to_ascii_4i function in lib/idna.c in libidn before version 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.
Original NVD description (English source)
idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948.