[arch-security] [ASA-201604-9] libtasn1: denial of service
rgacogne at archlinux.org
Sun Apr 17 10:05:22 UTC 2016
Arch Linux Security Advisory ASA-201604-9
Date : 2016-04-17
CVE-ID : CVE-2016-4008
Package : libtasn1
Type : denial of service
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package libtasn1 before version 4.8-1 is vulnerable to denial of
Upgrade to 4.8-1.
# pacman -Syu "libtasn1>=4.8-1"
The problem has been fixed upstream in version 4.8.
The libtasn1 library, in its 4.7 version, can loop for a long time or
indefinitely when it is used to parse DER representations of X.509
certificates, leading to a denial of service. Some of these loops may in
addition increase heap or stack usage, leading to more issues.
A remote attacker can cause an application using a vulnerable version of
libtasn1 to loop indefinitely by sending a crafted X.509 certificate,
causing a denial of service.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 801 bytes
Desc: OpenPGP digital signature
More information about the arch-security