{"id":"CVE-2006-0645","aliases":["DEBIAN-CVE-2006-0645","DSA-985-1","DSA-986-1","EUVD-2006-0652","GHSA-2w9r-mr74-qj9p","RHSA-2006:0207"],"status":"published","title":"Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x...","description":"Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via \"out-of-bounds access\" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03892,"percentile":0.9032,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2006-02-10T18:00:00Z","modified":"2026-06-26T10:04:21Z","fixes":[{"ecosystem":"Debian:3.1","package":"libtasn1-2","fixed_in":["0.2.10-3sarge1"],"sources":["osv"]},{"ecosystem":"Debian:3.1","package":"gnutls11","fixed_in":["1.0.16-13.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"gnutls","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"gnutls-debuginfo","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"gnutls-devel","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"gnutls","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"gnutls-debuginfo","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"gnutls-devel","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"gnutls","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"gnutls-debuginfo","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"gnutls-devel","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"gnutls","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"gnutls-debuginfo","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"gnutls-devel","fixed_in":["0:1.0.20-3.2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:3.1","package":"libtasn1-2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.10-3sarge1"}]}],"versions":["0.2.10-3"]},{"source":"osv","ecosystem":"Debian:3.1","package":"gnutls11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-13.2"}]}],"versions":["1.0.16-13.1","1.0.16-13.1sarge1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.20-3.2.2"}]}]}],"products":[{"vendor":"free_software_foundation_inc.","product":"libtasn1"}],"references":[{"url":"http://www.trustix.org/errata/2006/0008","tags":["vendor-advisory","x_refsource_TRUSTIX","x_transferred"]},{"url":"http://secunia.com/advisories/18815","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://securityreason.com/securityalert/446","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"]},{"url":"http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00043.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://secunia.com/advisories/19092","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://securitytracker.com/id?1015612","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.osvdb.org/23054","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://secunia.com/advisories/18794","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/18918","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2006:039","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://secunia.com/advisories/18830","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10540","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001059.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2006-0207.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001058.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.debian.org/security/2006/dsa-986","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.debian.org/security/2006/dsa-985","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2006/0496","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror\u0026view=markup","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200602-08.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://www.gleg.net/protover_ssl.shtml","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24606","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001060.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.securityfocus.com/bid/16568","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://secunia.com/advisories/18832","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://usn.ubuntu.com/251-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://secunia.com/advisories/19080","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.securityfocus.com/archive/1/424538/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://secunia.com/advisories/18898","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-0645","tags":["advisory"]},{"url":"https://usn.ubuntu.com/251-1"},{"url":"https://github.com/advisories/GHSA-2w9r-mr74-qj9p"},{"url":"https://access.redhat.com/errata/RHSA-2006:0207","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=180903","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0207.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-0645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=184097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-0645","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2006-0645","description":"Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via \"out-of-bounds access\" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.","status":"published","published":"2006-02-10T18:00:00Z","modified":"2024-08-07T16:41:29.006Z","updated_at":"2026-11-02T14:33:52.947472Z"}],"euvd":[{"id":"EUVD-2006-0652","description":"Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via \"out-of-bounds access\" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.","status":"published","published":"2006-02-10T18:00:00Z","modified":"2024-08-07T16:41:29Z","updated_at":"2026-11-03T01:16:08.538379Z"}],"ghsa":[{"id":"GHSA-2w9r-mr74-qj9p","title":"Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x...","description":"Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via \"out-of-bounds access\" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.","status":"published","published":"2022-05-01T06:41:37Z","modified":"2025-04-03T04:26:27Z","updated_at":"2026-11-02T15:00:45.047917Z"}],"nvd":[{"id":"CVE-2006-0645","description":"Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via \"out-of-bounds access\" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.","status":"published","published":"2006-02-10T18:06:00Z","modified":"2026-06-16T22:21:00.18Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:01:00.920802Z"}],"osv":[{"id":"DSA-985-1","title":"libtasn1-2 - buffer overflows","status":"published","published":"2006-03-06T00:00:00Z","modified":"2026-03-09T02:11:05.99112Z","updated_at":"2026-11-02T15:46:18.716547Z"},{"id":"DSA-986-1","title":"gnutls11 - buffer overflows","status":"published","published":"2006-03-06T00:00:00Z","modified":"2026-03-09T02:11:38.533163Z","updated_at":"2026-11-02T15:46:18.716547Z"},{"id":"RHSA-2006:0207","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-15T16:03:28Z","modified":"2026-06-26T10:04:21Z","updated_at":"2026-11-02T15:52:59.135214Z"}]}}