CVE-2015-2059

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=2e97c279Issue Tracking, Patch
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162537.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162549.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-07/msg00042.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-08/msg00098.html
http://www.debian.org/security/2016/dsa-3578
http://www.openwall.com/lists/oss-security/2015/02/23/25Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/72736
http://www.ubuntu.com/usn/USN-3068-1
https://github.com/jabberd2/jabberd2/issues/85Issue Tracking, Patch, Third Party Advisory
http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=2e97c279Issue Tracking, Patch
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162537.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162549.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-07/msg00042.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2016-08/msg00098.html
http://www.debian.org/security/2016/dsa-3578
http://www.openwall.com/lists/oss-security/2015/02/23/25Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/72736
http://www.ubuntu.com/usn/USN-3068-1
https://github.com/jabberd2/jabberd2/issues/85Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Aug 12, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-20605.3cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute d CVE-2015-20617.5Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving s CVE-2015-20627.2Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to CVE-2015-20634.3Integer overflow in unace 1.2b allows remote attackers to cause a denial of service (crash) via a small file header in an ace archive, which CVE-2015-20644.3Multiple cross-site scripting (XSS) vulnerabilities in DLGuard 5, 4.6, and 4.5 allow remote attackers to inject arbitrary web script or HTML CVE-2015-20657.5SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPr CVE-2015-20667.5SQL injection vulnerability in DLGuard 4.5 allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php.CVE-2015-20675.0Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remot CVE-2015-20684.3Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attacker CVE-2015-20694.3Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary w CVE-2015-20707.5SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitrary SQL commands via CVE-2015-20714.0Directory traversal vulnerability in cm/newui/blog/export.jsp in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote authenticated