CVE-2015-2806: Buffer Overflow
From http://lists.gnu.org/archive/html/help-libtasn1/2015-03/msg00002.html:
GNU Libtasn1 is a standalone library written in C for manipulating ASN.1 objects including DER/BER encoding/decoding. GNU Libtasn1 is used by GnuTLS to handle X.509 structures and by GNU Shishi to handle Kerberos V5 structures.
Noteworthy changes in release 4.4 (released 2015-03-29) [stable] - Corrected a two-byte stack overflow in asn1derdecoding. Reported by Hanno Böck.
Exact commit that fixes this: http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=4d4f992826a4962790ecd0cce6fbba4a415ce149
CVE request: http://seclists.org/oss-sec/2015/q1/1038
Other sources
Stack-based buffer overflow in asn1derdecoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2806?
CVE-2015-2806 has a moderate severity rating due to potential vulnerabilities in the GNU Libtasn1 library.
How do I fix CVE-2015-2806?
To resolve CVE-2015-2806, upgrade GNU Libtasn1 to version 4.4 or later.
Which software is affected by CVE-2015-2806?
CVE-2015-2806 affects various versions of GNU Libtasn1, specifically up to version 4.3, along with several Linux distributions.
Is there an official patch for CVE-2015-2806?
Yes, official patches can be found in the latest updates for the GNU Libtasn1 library in affected distributions.
What is the impact of CVE-2015-2806?
The impact of CVE-2015-2806 could lead to potential denial of service attacks due to improper handling of input.