CVE-2012-1569: The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length…

Unscored severity · published Mar 26, 2012

CVE-2012-1569

The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length…

–

CVSS

4.4%

EPSS

On KEV

Description

The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.

Exploitation

Is it being used?

Exploit prediction (EPSS)4.4% · higher than 91% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Gnutls · Gnu

through 3.0.15; 1.0.16; 1.0.17; 1.0.18; 1.0.19; 1.0.20; +34 more · source: NVD

Libtasn1 · Gnu

through 2.11; 0.1.0; 0.1.1; 0.1.2; 0.2.0; 0.2.1; +34 more · source: NVD