CVE-2015-2059

What it actually does

Out-of-bounds read in stringprep_utf8_to_ucs4 triggered by invalid UTF-8 input, exposing adjacent system memory and enabling potential further unspecified impacts.

Why it matters to the business

Possible leakage of sensitive memory contents or service instability in container snapshotter components; low active exploitation risk given age and lack of KEV listing, but still requires remediation in affected Chainguard and Wolfi distributions.

How an attack unfolds

An attacker supplies a crafted string containing invalid UTF-8 characters to a service path that invokes the vulnerable libin function, causing an out-of-bounds read that discloses memory or permits additional context-dependent abuse.

How to fix it

Upgrade fuse-overlayfs-snapshotter to 1.0.8-r4 or later in both Chainguard and Wolfi packages; rebuild and redeploy any dependent container images after the update.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases; perform targeted tests supplying invalid UTF-8 to stringprep paths and verify absence of crashes or memory disclosures.

Typical attack path

1. Locate an entry point accepting UTF-8 strings in affected fuse-overlayfs-snapshotter usage
2. Send malformed UTF-8 payload to trigger stringprep_utf8_to_ucs4
3. Observe or harvest leaked memory contents from the out-of-bounds read
4. Leverage disclosed data for further attacks if possible

How to detect it

Review application logs for UTF-8 processing errors or crashes around stringprep operations; inspect memory dumps or core files for evidence of out-of-bounds reads in libin code paths.

What your security team should do

• Apply the 1.0.8-r4 updates immediately to eliminate the memory corruption exposure
• Scan container registries and build pipelines for older fuse-overlayfs-snapshotter versions
• Add UTF-8 sanitization checks at application boundaries until patching is complete