CVE-2015-8948

HIGH7.5EPSS 2.0%

libidn - security update

Published: 9/7/2016Modified: 4/28/2026

Description

idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.

Affected packages (4)

Alpine/libidnfrom 0, < 1.33-r0
Debian/libidnfrom 0, < 1.33-1
Debian/libidnfrom 0, < 1.25-2+deb7u2
Debian/libidnfrom 0, < 1.29-1+deb8u2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2015-8948
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2015-8948