libuv: Buffer Overread

Background

libuv is a multi-platform support library with a focus on asynchronous I/O.

Description

libuv fails to ensure that a pointer lies within the bounds of a defined buffer in the uv__idna_toascii() function before reading and manipulating the memory at that address.

Impact

The overread can result in information disclosure or application crash.

Workaround

There is no known workaround at this time.

Resolution

All libuv users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-libs/libuv-1.41.1"