CVE-2016-4008

The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.
References
Link Resource
http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625
http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=f435825c0f527a8e52e6ffbc3ad0bc60531d537e
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182299.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182907.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183221.html
http://lists.opensuse.org/opensuse-updates/2016-06/msg00047.html
http://lists.opensuse.org/opensuse-updates/2016-06/msg00097.html
http://www.debian.org/security/2016/dsa-3568
http://www.openwall.com/lists/oss-security/2016/04/11/3
http://www.ubuntu.com/usn/USN-2957-1
http://www.ubuntu.com/usn/USN-2957-2
https://lists.gnu.org/archive/html/help-libtasn1/2016-04/msg00009.html
https://security.gentoo.org/glsa/201703-05
http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625
http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=f435825c0f527a8e52e6ffbc3ad0bc60531d537e
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182299.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182907.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183221.html
http://lists.opensuse.org/opensuse-updates/2016-06/msg00047.html
http://lists.opensuse.org/opensuse-updates/2016-06/msg00097.html
http://www.debian.org/security/2016/dsa-3568
http://www.openwall.com/lists/oss-security/2016/04/11/3
http://www.ubuntu.com/usn/USN-2957-1
http://www.ubuntu.com/usn/USN-2957-2
https://lists.gnu.org/archive/html/help-libtasn1/2016-04/msg00009.html
https://security.gentoo.org/glsa/201703-05
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

Configuration 2 (hide)

cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:gnu:libtasn1:*:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*

History

21 Nov 2024, 02:51

Type Values Removed Values Added
References () http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625 - () http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625 -
References () http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=f435825c0f527a8e52e6ffbc3ad0bc60531d537e - () http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=f435825c0f527a8e52e6ffbc3ad0bc60531d537e -
References () http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182299.html - () http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182299.html -
References () http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182907.html - () http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182907.html -
References () http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183221.html - () http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183221.html -
References () http://lists.opensuse.org/opensuse-updates/2016-06/msg00047.html - () http://lists.opensuse.org/opensuse-updates/2016-06/msg00047.html -
References () http://lists.opensuse.org/opensuse-updates/2016-06/msg00097.html - () http://lists.opensuse.org/opensuse-updates/2016-06/msg00097.html -
References () http://www.debian.org/security/2016/dsa-3568 - () http://www.debian.org/security/2016/dsa-3568 -
References () http://www.openwall.com/lists/oss-security/2016/04/11/3 - () http://www.openwall.com/lists/oss-security/2016/04/11/3 -
References () http://www.ubuntu.com/usn/USN-2957-1 - () http://www.ubuntu.com/usn/USN-2957-1 -
References () http://www.ubuntu.com/usn/USN-2957-2 - () http://www.ubuntu.com/usn/USN-2957-2 -
References () https://lists.gnu.org/archive/html/help-libtasn1/2016-04/msg00009.html - () https://lists.gnu.org/archive/html/help-libtasn1/2016-04/msg00009.html -
References () https://security.gentoo.org/glsa/201703-05 - () https://security.gentoo.org/glsa/201703-05 -

07 Nov 2023, 02:32

Type Values Removed Values Added
References
  • {'url': 'http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=f435825c0f527a8e52e6ffbc3ad0bc60531d537e', 'name': 'http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=f435825c0f527a8e52e6ffbc3ad0bc60531d537e', 'tags': [], 'refsource': 'CONFIRM'}
  • {'url': 'http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625', 'name': 'http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625', 'tags': [], 'refsource': 'CONFIRM'}
  • () http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=f435825c0f527a8e52e6ffbc3ad0bc60531d537e -
  • () http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625 -

Information

Published : 2016-05-05 18:59

Updated : 2024-11-21 02:51


NVD link : CVE-2016-4008

Mitre link : CVE-2016-4008

CVE.ORG link : CVE-2016-4008


JSON object : View

Products Affected

gnu

  • libtasn1

canonical

  • ubuntu_linux

opensuse

  • opensuse

fedoraproject

  • fedora
CWE
CWE-399

Resource Management Errors