CVE-2017-6891: Buffer Overflow
Two errors in the "asn1findnode()" function (lib/parseraux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6891?
CVE-2017-6891 has a high severity due to the potential for remote code execution resulting from a stack-based buffer overflow.
How do I fix CVE-2017-6891?
To fix CVE-2017-6891, update GnuTLS libtasn1 to a version that is not affected, specifically newer than 4.10.
Which versions of GnuTLS are affected by CVE-2017-6891?
CVE-2017-6891 affects GnuTLS libtasn1 version 4.10.
Does CVE-2017-6891 affect any other systems or software?
Yes, CVE-2017-6891 also affects Debian Linux versions prior to the security patches and Apache Bookkeeper version 4.12.1.
What specific exploitation method is associated with CVE-2017-6891?
CVE-2017-6891 can be exploited by tricking a user into processing a specially crafted assignments file with the asn1Coding utility.