From ${URL} : https://blog.fuzzing-project.org/9-Heap-overflow-invalid-read-in-Libtasn1-TFPA-0052015.html While fuzzing GnuTLS I discovered a malformed certificate input sample that would cause a heap overflow read of 99 bytes in the DER decoding functions of Libtasn1. The heap overflow happens in the function _asn1_extract_der_octet(). This issue was reported to the Libtasn1 developer on 16th April. A fix was committed on 20th April and is part of the Libtasn1 4.5 release. This issue was found with american fuzzy lop and address sanitizer. http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commitdiff;h=f979435823a02f842c41d49cd41cc81f25b5d677 Git commit / fix https://lists.gnu.org/archive/html/help-libtasn1/2015-04/msg00000.html Libtasn1 4.5 release notes https://crashes.fuzzing-project.org/TFPA-2015-005-libtasn1-4.4-heap-overflow.crt Sample malformed certificate exposing heap overflow (test with certtool -i --inder --infile=[sample] and address sanitizer or valgrind) @maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.
can be stabilized, please resolve/dup bug#544922 to avoid duplication.
Arches please stabilize: =dev-libs/libtasn1-4.5 Stable targets: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
Stable for PPC64.
Stable for HPPA.
amd64 stable
ia64 stable
sparc stable
ppc stable
x86 stable
alpha stable
arm stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one.
(In reply to Agostino Sarubbo from comment #11) > arm stable. > > Maintainer(s), please cleanup. > Security, please add it to the existing request, or file a new one. done
Arches and Maintainer(s), Thank you for your work. New GLSA Request filed.
CVE-2015-3622 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3622): The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.
This issue was resolved and addressed in GLSA 201509-04 at https://security.gentoo.org/glsa/201509-04 by GLSA coordinator Kristian Fiskerstrand (K_F).
