CVE-2015-3622: Buffer Overflow
A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded input. A specially crafted, DER-encoded input could cause an application using libtasn1 to perform an invalid read, causing the application to crash.
Upstream patch:
http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commitdiff;h=f979435823a02f842c41d49cd41cc81f25b5d677
Other sources
The asn1extractderoctet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3622?
CVE-2015-3622 is classified as a high severity vulnerability due to the potential for a heap-based buffer overflow that can lead to application crashes.
How do I fix CVE-2015-3622?
To fix CVE-2015-3622, update the libtasn1 library to version 4.5 or later.
Which software is affected by CVE-2015-3622?
CVE-2015-3622 affects libtasn1 versions up to 4.4, as well as specific versions of openSUSE and Fedora.
What is the nature of the flaw in CVE-2015-3622?
The flaw in CVE-2015-3622 is a heap-based buffer overflow that occurs when decoding certain DER-encoded input.
Can CVE-2015-3622 lead to security risks?
Yes, CVE-2015-3622 can lead to security risks by crashing applications and potentially allowing for exploitation in a malicious environment.