Red Hat Security AdvisoryRHSA-2014:0687
libtasn1 security update
Released 2014-06-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) libtasn1-3.3-5.el7_0
- Red Hat Enterprise Linux Client Optional (v. 7) libtasn1-devel-3.3-5.el7_0, libtasn1-tools-3.3-5.el7_0
- Red Hat Enterprise Linux ComputeNode (v. 7) libtasn1-3.3-5.el7_0
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libtasn1-devel-3.3-5.el7_0, libtasn1-tools-3.3-5.el7_0
- Red Hat Enterprise Linux Server (v. 7) libtasn1-3.3-5.el7_0, libtasn1-3.3-5.el7_0.ppc, libtasn1-devel-3.3-5.el7_0 +1
- Red Hat Enterprise Linux Server Optional (v. 7) libtasn1-tools-3.3-5.el7_0
- Red Hat Enterprise Linux Workstation (v. 7) libtasn1-3.3-5.el7_0, libtasn1-devel-3.3-5.el7_0
- Red Hat Enterprise Linux Workstation Optional (v. 7) libtasn1-tools-3.3-5.el7_0
Fixes 3 records
Priority LOW 39
The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.03789 · Published 2014-06-05 · Partial fix CWE-131
Priority LOW 33
Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.068 · Published 2014-06-05 · Partial fix
Priority LOW 29
The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.03817 · Published 2014-06-05 · Partial fix CWE-476
THREATIST.IORead the docs