CVE-2017-14062

What it actually does

Integer overflow in decode_digit during Punycode decoding leads to memory corruption, enabling denial of service or potential remote code execution.

Why it matters to the business

Systems relying on international domain name handling may experience crashes, outages, or full compromise if attackers supply malicious input, affecting availability and confidentiality of dependent services.

How an attack unfolds

An attacker crafts a specially formed Punycode string that triggers the integer overflow in the vulnerable decode_digit function when processed by Libidn2, causing memory corruption that can be leveraged for denial of service or further exploitation.

How to fix it

Upgrade Libidn2 to version 2.0.4 or later; for listed packages apply the exact fixes: libidn/libidn2 to commit 3284eb342cd0ed1a18786e3fcdf0cdd7e76676bd and prometheus-postgres-exporter variants to 0.15.0-r11.

How to confirm the fix worked

Verify installed Libidn2 version is 2.0.4 or newer; confirm package versions match the provided fixed releases and test decoding of internationalized strings for stability.

Typical attack path

1. Locate services accepting internationalized domain names or Punycode strings that use vulnerable Libidn2
2. Craft malicious input triggering integer overflow in decode_digit
3. Deliver payload via network request, DNS resolution, or application input
4. Trigger processing path leading to memory corruption and denial of service or code execution

How to detect it

Review application and system logs for crashes or errors during international domain name or Punycode processing; look for unexpected terminations in processes using Libidn2.

What your security team should do

• Prioritize upgrade of all Libidn2 instances and dependent packages to the specified fixed versions
• Scan inventories for any remaining vulnerable Libidn2 deployments
• Monitor for application crashes during string decoding operations