CVE Feed

    Dashboard / CVE / CVE-2017-6891

    CVE-2017-6891

    Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.

    Published:May 18, 2017
    Last Modified:Apr 20, 2025
    EPS:May 22, 2017
    EPSS Score:0.0092
    CVSS Score:8.8

    Affected Products

    Vendor
    Apache
    Product
    Bookkeeper
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Gnu
    Product
    Libtasn1

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2022-32531 (CVSS 5.9) — The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkee…
    CVE-2020-23922 (CVSS 7.1) — An issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based buffer over-read…
    CVE-2020-36230 (CVSS 7.5) — A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsi…
    CVE-2019-19924 (CVSS 5.3) — SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is ca…
    CVE-2019-17571 (CVSS 9.8) — Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which ca…
    CVE-2019-19906 (CVSS 7.5) — cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-serv…

    References

    http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=5520704d075802df25ce4ffccc010ba1641bd484
    http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html
    http://www.debian.org/security/2017/dsa-3861
    http://www.securityfocus.com/bid/98641
    http://www.securitytracker.com/id/1038619
    https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
    https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
    https://secuniaresearch.flexerasoftware.com/advisories/76125/
    https://secuniaresearch.flexerasoftware.com/secunia_research/2017-11/
    https://security.gentoo.org/glsa/201710-11
    http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=5520704d075802df25ce4ffccc010ba1641bd484
    http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html
    http://www.debian.org/security/2017/dsa-3861
    http://www.securityfocus.com/bid/98641
    http://www.securitytracker.com/id/1038619
    https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
    https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
    https://secuniaresearch.flexerasoftware.com/advisories/76125/
    https://secuniaresearch.flexerasoftware.com/secunia_research/2017-11/
    https://security.gentoo.org/glsa/201710-11

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High