AI analysis
CVE-2016-15059 is a heap buffer overflow vulnerability in the XS backend of the Net::IDN::Punycode Perl module. The flaw is triggered in the `encode_punycode` function when encoding a string whose Punycode output exceeds the pre-allocated buffer, due to missing bounds checks on the final digit and NUL terminator writes. An attacker who can supply a maliciously crafted internationalized domain name could corrupt the heap, potentially leading to arbitrary code execution or application crashes. Only systems using the XS backend of affected versions are vulnerable. As of the latest reports, there is no public proof-of-concept and exploitation in the wild is not known.
What to do: Upgrade Net::IDN::Punycode to version 2.301 or later to resolve the heap buffer overflow. If immediate patching is not feasible, avoid processing untrusted internationalized domain names with the XS backend.
Affected
| Net::IDN::Punycode | versions before 2.301 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each code point checks for room before every write, but the write of the last digit of each round and the write of the terminating NUL do not, so an input whose encoded form fills the buffer writes past its end. Only the XS backend is affected. Encoding an attacker-supplied string corrupts the heap.