| Name | CVE-2006-0645 |
| Description | Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-985-1, DSA-986-1 |
| Debian Bugs | 352182, 365234 |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| gnutls11 | source | sarge | 1.0.16-13.2 | DSA-986-1 | ||
| gnutls11 | source | (unstable) | (unfixed) | |||
| gnutls12 | source | (unstable) | 1.2.11-1 | |||
| gnutls13 | source | (unstable) | 1.3.5-1 | |||
| libtasn1-2 | source | sarge | 0.2.10-3sarge1 | DSA-985-1 | ||
| libtasn1-2 | source | (unstable) | (unfixed) | 352182, 365234 | ||
| libtasn1-3 | source | (unstable) | 0.3.4-1 |
upload of libtasn1-2 0.3.1-1 was reverted in 1:0.2.17-2 because of soname change