CVE-2017-6891

Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.

Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.

Jakub Jirasek of Secunia Research discovered that libtasn1 did not properly validate its input. This would allow an attacker to cause a crash by denial-of-service, or potentially execute arbitrary code, by tricking a user into processing a maliciously crafted assignments file (CVE-2017-6891).

This update for gnutls fixes the following issues:

• GNUTLS-SA-2017-3 / CVE-2017-7869: An out-of-bounds write in OpenPGP certificate decoding was fixed (bsc#1034173)
• CVE-2017-6891: A potential stack buffer overflow in the bundled libtasn1 was fixed (bsc#1040621)
• An address read of 4 bytes past the end of buffer in OpenPGP certificate parsing was fixed (bsc#1038337)

This update for libtasn1 fixes the following issues:

Security issues fixed:

• CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).
• CVE-2017-6891: Fixed a stack overflow in asn1_find_node() (bsc#1040621).

This update for libtasn1 fixes the following issues:

Security issue fixed:

• CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).
• CVE-2017-6891: Added safety check to fix a stack overflow issue (bsc#1040621).
• CVE-2021-46848: Fixed off-by-one array size check that affects asn1_encode_simple_der (bsc#1204690)

Jakub Jirasek discovered that GnuTLS incorrectly handled certain assignments files. If a user were tricked into processing a specially crafted assignments file, a remote attacker could possibly execute arbirary code.