Red Hat Security AdvisoryRHSA-2014:0596
libtasn1 security update
Released 2014-06-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) libtasn1-2.3-6.el6_5
- Red Hat Enterprise Linux Desktop Optional (v. 6) libtasn1-2.3-6.el6_5, libtasn1-devel-2.3-6.el6_5, libtasn1-tools-2.3-6.el6_5
- Red Hat Enterprise Linux HPC Node (v. 6) libtasn1-2.3-6.el6_5
- Red Hat Enterprise Linux HPC Node Optional (v. 6) libtasn1-2.3-6.el6_5, libtasn1-devel-2.3-6.el6_5, libtasn1-tools-2.3-6.el6_5
- Red Hat Enterprise Linux Server (v. 6) libtasn1-2.3-6.el6_5, libtasn1-2.3-6.el6_5.ppc, libtasn1-devel-2.3-6.el6_5 +1
- Red Hat Enterprise Linux Server Optional (v. 6) libtasn1-2.3-6.el6_5, libtasn1-tools-2.3-6.el6_5
- Red Hat Enterprise Linux Workstation (v. 6) libtasn1-2.3-6.el6_5, libtasn1-devel-2.3-6.el6_5
- Red Hat Enterprise Linux Workstation Optional (v. 6) libtasn1-2.3-6.el6_5, libtasn1-tools-2.3-6.el6_5
Fixes 3 records
Priority LOW 39
The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.03789 · Published 2014-06-05 · Partial fix CWE-131
Priority LOW 33
Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.068 · Published 2014-06-05 · Partial fix
Priority LOW 29
The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.03817 · Published 2014-06-05 · Partial fix CWE-476
THREATIST.IORead the docs