CVE-2017-14062 Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
CriticalCVSS 9.8
EPSS 3.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libidn(Debian:12) | < 1.33-2 | 1.33-2 |
| debian/libidn(Debian:13) | < 1.33-2 | 1.33-2 |
| debian/libidn(Debian:14) | < 1.33-2 | 1.33-2 |
| GNU libidn2 | < 2.0.4 | 2.0.4 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| debian linux | = 10.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-14062 vendor-advisory
- DSA-3988 third-party-advisory vendor-advisory
- gitlab.com release-notes third-party-advisory
- gitlab.com patch third-party-advisory
- [debian-lts-announce] 20180727 [SECURITY] [DLA 1447-1] libidn security update mailing-list third-party-advisory
- bugs.debian.org issue-tracking