CVE-2017-6891

NameCVE-2017-6891
DescriptionTwo errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-950-1, DSA-3861-1
Debian Bugs863186

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libtasn1-6 (PTS)buster4.13-3fixed
buster (security)4.13-3+deb10u1fixed
bullseye4.16.0-2+deb11u1fixed
bookworm4.19.0-2fixed
sid, trixie4.19.0-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libtasn1-3sourcewheezy2.13-2+deb7u4DLA-950-1
libtasn1-3source(unstable)(unfixed)
libtasn1-6sourcejessie4.2-3+deb8u3DSA-3861-1
libtasn1-6source(unstable)4.10-1.1863186

Notes

https://secuniaresearch.flexerasoftware.com/secunia_research/2017-11/
https://gitlab.com/gnutls/libtasn1/commit/5520704d075802df25ce4ffccc010ba1641bd484

Search for package or bug name: Reporting problems