CVE-2014-3468
No CVSS score yet. EPSS 3.8% chance of exploitation in the next 30 days.
The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.
- EPSS
- 3.8% chance of exploitation in the next 30 days; higher than 89% of CVEs (scores of 2026-10-31)
- CWE
- CWE-131
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- f5:arx_firmware
- gnu:gnutls
- gnu:libtasn1
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_tus
- redhat:enterprise_linux_workstation
- redhat:virtualization
- suse:linux_enterprise_desktop
- suse:linux_enterprise_high_availability_extension
- suse:linux_enterprise_server
- suse:linux_enterprise_software_development_kit
References
- http://advisories.mageia.org/MGASA-2014-0247.html
- http://git.savannah.gnu.org/cgit/libtasn1.git/commit/?id=1c3ccb3e040bf13e342ee60bc23b21b97b11923f
- http://linux.oracle.com/errata/ELSA-2014-0594.html
- http://linux.oracle.com/errata/ELSA-2014-0596.html
- http://lists.gnu.org/archive/html/help-libtasn1/2014-05/msg00006.html