CVE-2012-1569
- State
- Published
- Severity
- Not scored
- Published
- Mar 26, 2012
- Updated
- Aug 6, 2024
- Reserved
- Mar 12, 2012
Description
The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 57260third-party-advisory
- RHSA-2012:0427vendor-advisory
- 48578third-party-advisory
- RHSA-2012:0531vendor-advisory
- 49002third-party-advisory
- FEDORA-2012-4357vendor-advisory
- [oss-security] 20120320 Re: CVE request: libtasn1 "asn1_get_length_der()" DER decoding issuemailing-list
- [oss-security] 20120321 Re: CVE request: GnuTLS TLS record handling issue / MU-201202-01mailing-list
- 48488third-party-advisory
- USN-1436-1vendor-advisory
- FEDORA-2012-4342vendor-advisory
- FEDORA-2012-4451vendor-advisory
- http://www.gnu.org/software/gnutls/security.html
- https://bugzilla.redhat.com/show_bug.cgi?id=804920
- RHSA-2012:0488vendor-advisory
- FEDORA-2012-4308vendor-advisory
- SUSE-SU-2014:0320vendor-advisory
- [gnutls-devel] 20120316 gnutls 3.0.16mailing-list
- 1026829vdb-entry
- http://linux.oracle.com/errata/ELSA-2014-0596.html
- 48596third-party-advisory
- 50739third-party-advisory
- 48397third-party-advisory
- 48505third-party-advisory
- http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/
- [help-libtasn1] 20120319 GNU Libtasn1 2.12 releasedmailing-list
- [help-libtasn1] 20120319 minimal fix to security issuemailing-list
- [oss-security] 20120320 CVE request: libtasn1 "asn1_get_length_der()" DER decoding issuemailing-list
- DSA-2440vendor-advisory
- MDVSA-2012:039vendor-advisory
- FEDORA-2012-4409vendor-advisory
- 20120320 Mu Dynamics, Inc. Security Advisories MU-201202-01 and MU-201202-02 for GnuTLS and Libtasn1mailing-list
- FEDORA-2012-4417vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.