CVE-2015-2806

NameCVE-2015-2806
DescriptionStack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-195-1, DSA-3220-1
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libtasn1-6 (PTS)stretch (security), stretch4.10-1.1+deb9u1fixed
buster4.13-3fixed
bullseye, sid4.16.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libtasn1-3sourcesqueeze2.7-1+squeeze+3DLA-195-1
libtasn1-3sourcewheezy2.13-2+deb7u2DSA-3220-1
libtasn1-3source(unstable)(unfixed)
libtasn1-6sourceexperimental4.4-1
libtasn1-6source(unstable)4.2-3

Notes

https://gitlab.com/gnutls/libtasn1/commit/4d4f992826a4962790ecd0cce6fbba4a415ce149
https://www.openwall.com/lists/oss-security/2015/03/29/4
Only in the asn1 definition parser, not in the asn1 parser itself
https://lists.gnu.org/archive/html/help-libtasn1/2015-01/msg00000.html

Search for package or bug name: Reporting problems