bugtraq - [SECURITY] [DSA 3988-1] libidn2-0 security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 30 Sep 2017 19:18:58 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3988-1] libidn2-0 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3988-1                   security@...ian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
September 30, 2017                    https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libidn2-0
CVE ID         : CVE-2017-14062
Debian Bug     : 873902

An integer overflow vulnerability was discovered in decode_digit() in
libidn2-0, the GNU library for Internationalized Domain Names (IDNs),
allowing a remote attacker to cause a denial of service against an
application using the library (application crash).

For the oldstable distribution (jessie), this problem has been fixed
in version 0.10-2+deb8u1.

For the stable distribution (stretch), this problem has been fixed in
version 0.16-1+deb9u1.

For the testing distribution (buster), this problem has been fixed
in version 2.0.2-4.

For the unstable distribution (sid), this problem has been fixed in
version 2.0.2-4.

We recommend that you upgrade your libidn2-0 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlnP7eJfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0RJlRAAiZs0FzE83RAdXucLXpHgdU+sHtAvg26rPlJp6hzIVXA5LgZds0UB8hQy
0JEZQ4PjjJTGcj0a0e21rf+065m01T9WkLFMHStjH12yrXUOrDCoSGyzM6i9ppdT
w9ga4KuhvSQ4qFmFqH6j2Kyg1kKVrKq1oBBjcyZL82spntMrWGIar86s7RbSNfF0
PQS5wKkEgkXpT5Zi16DElBVoGNPOaZH2dChu0rbK8Ag3+8DmXJMwyRF/FXBSeT2z
6raN+0wvNDRFc0+P2AzzXd7e/hXZPLQt00lrfAj0FrLWojFIYCZCZZDH+t7nGoMj
VDF2I9JNsmqKRu1EKmOoe/3fvVzODm45S0Id/YGtWTC7NpgcD4ttj1pBY9X3PLCE
rUXiQWwJazfo/TggpZhhJPJ41X7PgXeya7iX1Fz0X6uFZGNgyi93N0Gq1vnXw4Dm
F6hhjuhjwvgCnQwpWhwyYbOZGTdnxLoVt/daOJgdUXe3cNwg6uP4GWuyVaNXCDYU
l+EiS5upxWqPgqOp64qC/1MtOrpqjb9ZjwblXQI+Y2Oc3m1owP6bmMBYnGUviZVW
D00JHjlpBiQ+EHMksUyBBFHougywm3ApVTPNkCIEAbWXGcFabGQR/W2j4p1o14OV
85WRy6fqsqk4mAFleD5ifFWF6+EpDDWHjDp9TU7+s8RCsiHnjQc=
=nUTT
-----END PGP SIGNATURE-----