CVEvulnerability
CVE-2006-0645
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2006-02-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.
Affected configurations
• free software foundation inc. libtasn1 0.1.0
• free software foundation inc. libtasn1 0.1.1
• free software foundation inc. libtasn1 0.1.2
• free software foundation inc. libtasn1 0.2.0
• free software foundation inc. libtasn1 0.2.1
• free software foundation inc. libtasn1 0.2.2
• free software foundation inc. libtasn1 0.2.3
• free software foundation inc. libtasn1 0.2.4
• free software foundation inc. libtasn1 0.2.5
• free software foundation inc. libtasn1 0.2.6
• free software foundation inc. libtasn1 0.2.7
• free software foundation inc. libtasn1 0.2.8
• free software foundation inc. libtasn1 0.2.9
• free software foundation inc. libtasn1 0.2.10
• free software foundation inc. libtasn1 0.2.11
• free software foundation inc. libtasn1 0.2.12
• free software foundation inc. libtasn1 0.2.13
• free software foundation inc. libtasn1 0.2.14
• free software foundation inc. libtasn1 0.2.15
• free software foundation inc. libtasn1 0.2.16
• free software foundation inc. libtasn1 0.2.17
References
- http://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup josefsson.org
- http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror&view=markup josefsson.org
- http://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch josefsson.org
- http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001058.html lists.gnupg.org
- http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001059.html lists.gnupg.org
- http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001060.html lists.gnupg.org
- http://rhn.redhat.com/errata/RHSA-2006-0207.html rhn.redhat.com
- http://secunia.com/advisories/18794 secunia.com
- http://secunia.com/advisories/18815 secunia.com
- http://secunia.com/advisories/18830 secunia.com
- http://secunia.com/advisories/18832 secunia.com
- http://secunia.com/advisories/18898 secunia.com
- http://secunia.com/advisories/18918 secunia.com
- http://secunia.com/advisories/19080 secunia.com
- http://secunia.com/advisories/19092 secunia.com
- http://securityreason.com/securityalert/446 securityreason.com
- http://securitytracker.com/id?1015612 securitytracker.com
- http://www.debian.org/security/2006/dsa-985 www.debian.org
- http://www.debian.org/security/2006/dsa-986 www.debian.org
- http://www.gentoo.org/security/en/glsa/glsa-200602-08.xml www.gentoo.org
- http://www.gleg.net/protover_ssl.shtml www.gleg.net
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:039 www.mandriva.com
- http://www.osvdb.org/23054 www.osvdb.org
- http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00043.html www.redhat.com
- http://www.securityfocus.com/archive/1/424538/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/16568 www.securityfocus.com
- http://www.trustix.org/errata/2006/0008 www.trustix.org
- http://www.vupen.com/english/advisories/2006/0496 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24606 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10540 oval.cisecurity.org
- https://usn.ubuntu.com/251-1/ usn.ubuntu.com
- http://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup josefsson.org
- http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror&view=markup josefsson.org
- http://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch josefsson.org
- http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001058.html lists.gnupg.org
- http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001059.html lists.gnupg.org
- http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001060.html lists.gnupg.org
- http://rhn.redhat.com/errata/RHSA-2006-0207.html rhn.redhat.com
- http://secunia.com/advisories/18794 secunia.com
- http://secunia.com/advisories/18815 secunia.com
- http://secunia.com/advisories/18830 secunia.com
- http://secunia.com/advisories/18832 secunia.com
- http://secunia.com/advisories/18898 secunia.com
- http://secunia.com/advisories/18918 secunia.com
- http://secunia.com/advisories/19080 secunia.com
- http://secunia.com/advisories/19092 secunia.com
- http://securityreason.com/securityalert/446 securityreason.com
- http://securitytracker.com/id?1015612 securitytracker.com
- http://www.debian.org/security/2006/dsa-985 www.debian.org
- http://www.debian.org/security/2006/dsa-986 www.debian.org
- http://www.gentoo.org/security/en/glsa/glsa-200602-08.xml www.gentoo.org
- http://www.gleg.net/protover_ssl.shtml www.gleg.net
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:039 www.mandriva.com
- http://www.osvdb.org/23054 www.osvdb.org
- http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00043.html www.redhat.com
- http://www.securityfocus.com/archive/1/424538/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/16568 www.securityfocus.com
- http://www.trustix.org/errata/2006/0008 www.trustix.org
- http://www.vupen.com/english/advisories/2006/0496 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24606 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10540 oval.cisecurity.org
- https://usn.ubuntu.com/251-1/ usn.ubuntu.com