This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

This update was imported from the SUSE:SLE-12:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the     ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite     recursion) via a crafted certificate. (CVE-2016-4008)

Note that Nessus relies on the presence of the package as reported by the vendor.

Update to 4.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201703-05 (GNU Libtasn1: Denial of Service)

    Libtasn1 does not correctly handle certain malformed DER certificates.
  Impact :

    A remote attacker could entice a user or automated system to process a       specially crafted certificate using Libtasn1, resulting in a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91868	openSUSE Security Update : libtasn1 (openSUSE-2016-773)	Nessus	SuSE Local Security Checks	2016/6/28	2021/1/19	medium
219565	Linux Distros Unpatched Vulnerability : CVE-2016-4008	Nessus	Misc.	2025/3/4	2025/9/14	medium
90770	Fedora 22 : libtasn1-4.8-1.fc22 (2016-96bfd9e873)	Nessus	Fedora Local Security Checks	2016/4/28	2021/1/11	medium
91619	openSUSE Security Update : libtasn1 (openSUSE-2016-716)	Nessus	SuSE Local Security Checks	2016/6/15	2021/1/19	medium
90640	Fedora 24 : libtasn1-4.8-1.fc24 (2016-048ffb6235)	Nessus	Fedora Local Security Checks	2016/4/22	2021/1/11	medium
93151	SUSE SLES11 Security Update : libtasn1 (SUSE-SU-2016:1600-1)	Nessus	SuSE Local Security Checks	2016/8/29	2026/1/28	medium
99012	GLSA-201703-05 : GNU Libtasn1: Denial of Service	Nessus	Gentoo Local Security Checks	2017/3/28	2025/12/29	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium