CVE-2015-2806

NameCVE-2015-2806
DescriptionStack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-195-1, DSA-3220-1
NVD severityhigh (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libtasn1-3 (PTS)wheezy2.13-2+deb7u2fixed
wheezy (security)2.13-2+deb7u5fixed
libtasn1-6 (PTS)jessie (security), jessie4.2-3+deb8u3fixed
stretch4.10-1.1fixed
buster, sid4.12-2.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libtasn1-3source(unstable)(unfixed)high
libtasn1-3sourcesqueeze2.7-1+squeeze+3highDLA-195-1
libtasn1-3sourcewheezy2.13-2+deb7u2highDSA-3220-1
libtasn1-6source(unstable)4.2-3high
libtasn1-6sourceexperimental4.4-1high

Notes

http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=4d4f992826a4962790ecd0cce6fbba4a415ce149
http://www.openwall.com/lists/oss-security/2015/03/29/4
Only in the asn1 definition parser, not in the asn1 parser itself
https://lists.gnu.org/archive/html/help-libtasn1/2015-01/msg00000.html

Search for package or bug name: Reporting problems