CVE-2016-6263
HighSummary
The stringprep_utf8_nfkc_normalize function in libidn before version 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
Risk Assessment
Attackers can exploit this vulnerability to disrupt application functionality, potentially leading to service downtime and loss of system availability.
Recommendation
It is recommended to update libidn to version 1.33 or later to mitigate this vulnerability.
Other vulnerabilities in libidn
See all- CVE-2016-6262High
In libidn before version 1.33, a vulnerability may allow remote attackers to obtain sensitive memory information by reading a zero byte as input, triggering an out-of-bounds read.
- CVE-2016-6261High
The idna_to_ascii_4i function in lib/idna.c in libidn before version 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.
Original NVD description (English source)
The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.