Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.5
CVSSv2

CVE-2014-3468

Published: 05/06/2014 Updated: 16/11/2020
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
VMScore: 668
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Subscribe to Gnutls

Vulnerability Summary

The asn1_get_bit_der function in GNU Libtasn1 prior to 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent malicious users to cause out-of-bounds access via crafted ASN.1 data.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

gnu gnutls

gnu libtasn1

redhat virtualization 6.0

debian debian linux 7.0

redhat enterprise linux desktop 5.0

redhat enterprise linux desktop 6.0

redhat enterprise linux desktop 7.0

redhat enterprise linux eus 6.5

redhat enterprise linux eus 7.3

redhat enterprise linux eus 7.4

redhat enterprise linux eus 7.5

redhat enterprise linux eus 7.6

redhat enterprise linux eus 7.7

redhat enterprise linux server 5.0

redhat enterprise linux server 6.0

redhat enterprise linux server 7.0

redhat enterprise linux server aus 6.5

redhat enterprise linux server aus 7.3

redhat enterprise linux server aus 7.4

redhat enterprise linux server aus 7.6

redhat enterprise linux server aus 7.7

redhat enterprise linux server tus 6.5

redhat enterprise linux server tus 7.3

redhat enterprise linux server tus 7.6

redhat enterprise linux server tus 7.7

redhat enterprise linux workstation 5.0

redhat enterprise linux workstation 6.0

redhat enterprise linux workstation 7.0

suse linux enterprise desktop 11

suse linux enterprise high availability extension 11

suse linux enterprise server 11

suse linux enterprise software development kit 11

f5 arx_firmware

Vendor Advisories

Ubuntu Security Notice: libtasn1-3, libtasn1-6 vulnerabilities
Libtasn1 could be made to crash or run programs as your login if it processed specially crafted data ...
Debian Security Advisories: DSA-3056-1 libtasn1-3 -- security update
Several vulnerabilities were discovered in libtasn1-3, a library that manages ASN1 (Abstract Syntax Notation One) structures An attacker could use those to cause a denial-of-service via out-of-bounds access or NULL pointer dereference For the stable distribution (wheezy), these problems have been fixed in version 213-2+deb7u1 We recommend that ...
Amazon Linux AMI: ALAS-2014-359
It was discovered that the asn1_get_bit_der() function of the libtasn1 library incorrectly reported the length of ASN1-encoded data Specially crafted ASN1 input could cause an application using libtasn1 to perform an out-of-bounds access operation, causing the application to crash or, possibly, execute arbitrary code (CVE-2014-3468) Multiple in ...
Red Hat: CVE-2014-3468
The asn1_get_bit_der function in GNU Libtasn1 before 36 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN1 data ...

References

CWE-131http://rhn.redhat.com/errata/RHSA-2014-0594.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1102323http://rhn.redhat.com/errata/RHSA-2014-0596.htmlhttp://git.savannah.gnu.org/cgit/libtasn1.git/commit/?id=1c3ccb3e040bf13e342ee60bc23b21b97b11923fhttp://lists.gnu.org/archive/html/help-libtasn1/2014-05/msg00006.htmlhttp://linux.oracle.com/errata/ELSA-2014-0596.htmlhttp://secunia.com/advisories/59057http://secunia.com/advisories/59021http://linux.oracle.com/errata/ELSA-2014-0594.htmlhttp://secunia.com/advisories/58614http://secunia.com/advisories/58591http://secunia.com/advisories/60415http://rhn.redhat.com/errata/RHSA-2014-0815.htmlhttp://www.debian.org/security/2014/dsa-3056http://secunia.com/advisories/61888http://www.mandriva.com/security/advisories?name=MDVSA-2015:116http://advisories.mageia.org/MGASA-2014-0247.htmlhttp://www.novell.com/support/kb/doc.php?id=7015303http://www.novell.com/support/kb/doc.php?id=7015302http://support.f5.com/kb/en-us/solutions/public/15000/400/sol15423.htmlhttp://secunia.com/advisories/60320http://secunia.com/advisories/59408http://rhn.redhat.com/errata/RHSA-2014-0687.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-06/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-06/msg00002.htmlhttps://usn.ubuntu.com/2294-1/https://nvd.nist.govhttps://access.redhat.com/security/cve/cve-2014-3468
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-2907hardcodedinjectCVE-2024-20359CVE-2024-2467CVE-2024-4077CVE-2024-22391cameraCVE-2024-20353
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook