CVE-2016-4574: High severity centos libksba vulnerability
Published Jun 13, 2016
·Updated
Off-by-one error in the appendutf8value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read) via invalid utf-8 encoded data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-4356.
Affected Software
7 affected components
gnupg Libksba<=1.3.3
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=15.10
Canonical Ubuntu Linux=16.04
openSUSE Leap=42.1
openSUSE openSUSE=13.2
Event History
Jun 13, 2016
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-4574?
CVE-2016-4574 is considered to have a medium severity rating due to its potential to cause denial of service.
2
How do I fix CVE-2016-4574?
To fix CVE-2016-4574, update Libksba to version 1.3.4 or later.
3
Which software versions are affected by CVE-2016-4574?
Affected software versions for CVE-2016-4574 include Libksba versions prior to 1.3.4 and specific versions of Ubuntu and openSUSE.
4
What type of vulnerability is CVE-2016-4574?
CVE-2016-4574 is an off-by-one error that leads to an out-of-bounds read.
5
Can CVE-2016-4574 be exploited remotely?
Yes, CVE-2016-4574 can be exploited remotely by attackers using invalid UTF-8 encoded data.