CVE-2014-3467 Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.
MediumCVSS 5.0
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libtasn1-6(Debian:12) | < 3.6-1 | 3.6-1 |
| debian/libtasn1-6(Debian:13) | < 3.6-1 | 3.6-1 |
| debian/libtasn1-6(Debian:14) | < 3.6-1 | 3.6-1 |
| gnutls | < 3.5.7 | 3.5.7 |
| GNU libtasn1 | < 3.6 | 3.6 |
| redhat virtualization | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 6.5 | No fix listed |
| redhat enterprise linux eus | = 7.3 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.5 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 6.5 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 6.5 | No fix listed |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| SUSE linux enterprise desktop | = 11-sp3 | No fix listed |
| SUSE linux enterprise high availability extension | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp1 | No fix listed |
| SUSE linux enterprise server | = 11-sp2 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp3 | No fix listed |
| f5 arx firmware | >= 6.0.0, <= 6.4.0 | No fix listed |
References
- Debian Security Tracker CVE-2014-3467 vendor-advisory
- advisories.mageia.org third-party-advisory
- linux.oracle.com third-party-advisory
- linux.oracle.com third-party-advisory
- [help-libtasn1] 20140525 GNU Libtasn1 3.6 released mailing-list patch vendor-advisory
- SUSE-SU-2014:0758 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2014:0788 mailing-list third-party-advisory vendor-advisory
- RHSA-2014:0594 third-party-advisory vendor-advisory
- RHSA-2014:0596 third-party-advisory vendor-advisory
- RHSA-2014:0687 third-party-advisory vendor-advisory
- RHSA-2014:0815 third-party-advisory vendor-advisory
- 58591 third-party-advisory
- 58614 third-party-advisory
- 59021 third-party-advisory
- 59057 third-party-advisory
- 59408 third-party-advisory
- 60320 third-party-advisory
- 60415 third-party-advisory
- 61888 third-party-advisory
- support.f5.com third-party-advisory
- DSA-3056 third-party-advisory vendor-advisory
- MDVSA-2015:116 third-party-advisory vendor-advisory
- www.novell.com third-party-advisory
- www.novell.com third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory