CVE-2022-3515

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

Libksba is a library to make the tasks of working with X.509 certificates,CMS data and related objects more easy. It provides a highlevel interface to the implemented protocols and presents the data in a consistent way.

Security Fix(es):

A bug found in libksba, the library used by GnuPG for parsing the ASN.1 structures as used by S/MIME. The bug affects all versions of Libksba before 1.6.2 and may be used for remote code execution.

https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html https://dev.gnupg.org/T6230 https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b https://lwn.net/Articles/911467/(CVE-2022-3515)

KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS.

Security Fix(es):

• libksba: integer overflow may lead to remote code execution (CVE-2022-3515)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS.

Security Fix(es):

• libksba: integer overflow may lead to remote code execution (CVE-2022-3515)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS.

Security Fix(es):

• libksba: integer overflow may lead to remote code execution (CVE-2022-3515)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS.

Security Fix(es):

• libksba: integer overflow may lead to remote code execution (CVE-2022-3515)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2022-3515: detect a possible overflow directly in the TLV parser
• CVE-2022-47629: fix an integer overflow in the CRL signature parser

• CVE-2022-3515: detect a possible overflow directly in the TLV parser
• CVE-2022-47629: fix an integer overflow in the CRL signature parser

• CVE-2022-3515: detect a possible overflow directly in the TLV parser
• CVE-2022-47629: fix an integer overflow in the CRL signature parser

• CVE-2022-3515: detect a possible overflow directly in the TLV parser
• CVE-2022-47629: fix an integer overflow in the CRL signature parser

• SECURITY UPDATE: integer overflow in the TLV parser
  • debian/patches/CVE-2022-3515.patch: detect a possible overflow directly in the TLV parser
  • CVE-2022-3515
• SECURITY UPDATE: integer overflow in the CRL signature parser
  • debian/patches/CVE-2022-47629.patch: fix an integer overflow in the CRL signature parser
  • CVE-2022-47629
• Enable internal tests

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

Integer Overflow in LibKSBA. (CVE-2022-3515)

These are all security issues fixed in the libksba-devel-1.6.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libksba fixes the following issues:

• CVE-2022-3515: Fixed a possible overflow in the TLV parser (bsc#1204357).

This update for libksba fixes the following issues:

• CVE-2022-3515: Fixed a possible overflow in the TLV parser (bsc#1204357).

It was discovered that an integer overflow could be triggered in Libksba when decoding certain data. An attacker could use this issue to cause a denial of service (application crash) or possibly execute arbitrary code.