Unscored severity · published Feb 10, 2006
CVE-2006-0645
Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and…
–
CVSS
3.9%
EPSS
No
On KEV
Description
Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libtasn1 · Free Software Foundation Inc.
0.1.0; 0.1.1; 0.1.2; 0.2.0; 0.2.1; 0.2.2; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0645
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0645
josefsson.org
http://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup
josefsson.org
http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror&view=markup
josefsson.org
http://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch
lists.gnupg.org
http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001058.html
lists.gnupg.org
http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001059.html
lists.gnupg.org
http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001060.html
More from Libtasn1
–
CVE-2004-0401
Unknown vulnerability in libtasn1 0.1.x before 0.1.2, and 0.2.x before 0.2.7, related to the DER parsing functions