NetSight
IP …
high7.5

CVE-2014-3468

The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-depen…

Impact

The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.

Affected products

VendorProductAffected versions
GnuGnutls
before 3.5.7
GnuLibtasn1
before 3.6
RedhatVirtualization
Version 6.0
DebianDebian Linux
Version 7.0
RedhatEnterprise Linux Desktop
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Eus
Versions 6.5, 7.3, 7.4, 7.5, 7.6, 7.7
RedhatEnterprise Linux Server
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 6.5, 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Server Tus
Versions 6.5, 7.3, 7.6, 7.7
RedhatEnterprise Linux Workstation
Versions 5.0, 6.0, 7.0
SuseLinux Enterprise Desktop
Version 11
SuseLinux Enterprise High Availability Extension
Version 11

Weakness classification

CWE-131

References