Bug 38246 - libtasn1-3: Multiple issues (4.0)
Summary: libtasn1-3: Multiple issues (4.0)
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: Security updates
Version: UCS 4.0
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 4.0-3-errata
Assignee: Felix Botner
QA Contact: Daniel Tröder
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-13 14:49 CEST by Arvid Requate
Modified: 2015-09-24 14:36 CEST (History)
2 users (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Customer ID:
Max CVSS v3 score:
requate: Patch_Available+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2015-04-13 14:49:31 CEST 
Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors (CVE-2015-2806)

Original report says: "This is only in the asn1 definition parser, not in the asn1 parser itself, so the impact is probably minor."

Note: GNU Libtasn1 is used by GnuTLS to handle X.509 structures.
Comment 1 Felix Botner univentionstaff 2015-09-11 10:18:11 CEST 
imported libtasn1-3 2.13-2+deb7u2 from wheezy and built in errata4.0-3.
YAML: 2015-09-11-libtasn1-3.yaml
Comment 2 Daniel Tröder univentionstaff 2015-09-18 10:06:17 CEST 
OK: DEBIAN_FRONTEND=noninteractive apt-get install -y libtasn1-3
OK: /usr/share/doc/libtasn1-3/changelog.Debian.gz
OK: r63391 / 2015-09-11-libtasn1-3.yaml / CVE…
OK: Test: wget --secure-protocol=TLSv1 --ca-certificate=/etc/univention/ssl/ucsCA/CAcert.pem https://$(hostname -f)/ -O /dev/null &>/dev/null && echo OK
Comment 3 Janek Walkenhorst univentionstaff 2015-09-24 14:36:46 CEST 
<http://errata.software-univention.de/ucs/4.0/332.html>