{"id":"CVE-2014-3468","aliases":["DEBIAN-CVE-2014-3468","DLA-77-1","DSA-3056-1","EUVD-2014-3480","GHSA-qg3j-x87h-jwjm","MGASA-2014-0247","RHSA-2014:0594","RHSA-2014:0596","RHSA-2014:0687","RHSA-2014:0815","SUSE-SU-2015:0901-1","UBUNTU-CVE-2014-3468","USN-2294-1","openSUSE-SU-2024:10414-1"],"status":"published","title":"The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a...","description":"The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03789,"percentile":0.90041,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-131"],"published":"2014-06-02T18:44:30Z","modified":"2026-10-23T15:47:32Z","fixes":[{"ecosystem":"Debian:12","package":"libtasn1-6","fixed_in":["3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libtasn1-6","fixed_in":["3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libtasn1-6","fixed_in":["3.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libtasn1-6","fixed_in":["3.4-3ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libtasn1-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libtasn1-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libtasn1-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libtasn1-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-1+squeeze+2"}]}],"versions":["2.7-1","2.7-1+squeeze+1"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"libtasn1-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13-2+deb7u1"}]}],"versions":["2.13-2"],"bundled":3},{"source":"osv","ecosystem":"Mageia:3","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-1.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6-1.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-6.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libtasn1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libtasn1-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libtasn1-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3-5.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"rhev-hypervisor6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5-20140624.0.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libtasn1-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-3ubuntu0.1"}]}],"versions":["3.3-2","3.4-2","3.4-3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libtasn1-6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4-3ubuntu0.1"}]}],"versions":["3.3-2","3.4-2","3.4-3"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libtasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-1.3"}]}],"bundled":6}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"f5","product":"arx_firmware"},{"vendor":"gnu","product":"gnutls"},{"vendor":"gnu","product":"libtasn1"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"redhat","product":"virtualization"},{"vendor":"suse","product":"linux_enterprise_desktop"},{"vendor":"suse","product":"linux_enterprise_high_availability_extension"},{"vendor":"suse","product":"linux_enterprise_server"},{"vendor":"suse","product":"linux_enterprise_software_development_kit"}],"references":[{"url":"http://secunia.com/advisories/60320","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3056","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://git.savannah.gnu.org/cgit/libtasn1.git/commit/?id=1c3ccb3e040bf13e342ee60bc23b21b97b11923f","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.novell.com/support/kb/doc.php?id=7015302","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/59057","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://support.f5.com/kb/en-us/solutions/public/15000/400/sol15423.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://linux.oracle.com/errata/ELSA-2014-0596.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:116","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/59021","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/61888","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://advisories.mageia.org/MGASA-2014-0247.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0815.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0596.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.gnu.org/archive/html/help-libtasn1/2014-05/msg00006.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Vendor Advisory","advisory","article","fix","web","report"]},{"url":"http://www.novell.com/support/kb/doc.php?id=7015303","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://linux.oracle.com/errata/ELSA-2014-0594.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102323","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://secunia.com/advisories/58591","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0687.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/58614","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0594.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/60415","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/59408","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3468","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qg3j-x87h-jwjm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3468","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0247.html","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3467","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3468","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3469","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13456","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0594","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1101932","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102329","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0594.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3466","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3466","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3466","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3467","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3467","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3468","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3468","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3469","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3469","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0596","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0596.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0687","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0687.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0815","tags":["advisory"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1107789","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0815.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150901-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/880735","tags":["report"]},{"url":"https://bugzilla.suse.com/880737","tags":["report"]},{"url":"https://bugzilla.suse.com/880738","tags":["report"]},{"url":"https://bugzilla.suse.com/924828","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2806","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-3468","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2294-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3467","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3469","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4008","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3468","description":"The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.","status":"published","published":"2014-06-05T20:00:00Z","modified":"2024-08-06T10:43:06.299Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-3480","description":"The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.","status":"published","published":"2014-06-05T20:00:00Z","modified":"2024-08-06T10:43:06Z","updated_at":"2026-11-03T01:57:10.864648Z"}],"ghsa":[{"id":"GHSA-qg3j-x87h-jwjm","title":"The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a...","description":"The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.","status":"published","published":"2022-05-13T01:13:33Z","modified":"2023-02-01T05:04:10Z","cwes":["CWE-131"],"updated_at":"2026-11-02T14:50:07.876412Z"}],"nvd":[{"id":"CVE-2014-3468","description":"The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.","status":"published","published":"2014-06-05T20:55:06.283Z","modified":"2026-06-17T00:08:14.267Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-131"],"updated_at":"2026-11-02T14:02:54.464139Z"}],"osv":[{"id":"CVE-2014-3468","description":"The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.","status":"published","published":"2014-06-05T20:55:06Z","modified":"2026-04-16T06:19:54.618692781Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3468","description":"The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.","status":"published","published":"2014-06-05T20:55:06.283Z","modified":"2026-10-23T15:47:32.06895578Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-77-1","title":"libtasn1-3 - security update","status":"published","published":"2014-10-26T00:00:00Z","modified":"2026-03-09T02:08:30.970716Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3056-1","title":"libtasn1-3 - security update","status":"published","published":"2014-10-26T00:00:00Z","modified":"2026-03-09T01:20:46.50755Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0247","title":"Updated libtasn1 packages fix CVE-2014-3467-9","description":"Updated libtasn1 packages fix security vulnerabilities:\n\nMultiple buffer boundary check issues were discovered in libtasn1 library,\ncausing it to read beyond the boundary of an allocated buffer.  An untrusted\nASN.1 input could cause an application using the library to crash\n(CVE-2014-3467).\n\nIt was discovered that libtasn1 library function asn1_get_bit_der() could\nincorrectly report negative bit length of the value read from ASN.1 input.\nThis could possibly lead to an out of bounds access in an application using\nlibtasn1, for example in case if application tried to terminate read value\nwith NUL byte (CVE-2014-3468).\n\nA NULL pointer dereference flaw was found in libtasn1's\nasn1_read_value_type() / asn1_read_value() function. If an application\ncalled the function with a NULL value for an ivalue argument to determine\nthe amount of memory needed to store data to be read from the ASN.1 input,\nlibtasn1 could incorrectly attempt to dereference the NULL pointer, causing\nan application using the library to crash (CVE-2014-3469).\n","status":"published","published":"2014-06-02T18:44:30Z","modified":"2026-04-16T06:22:33.021713451Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10414-1","title":"libtasn1-4.9-1.3 on GA media","description":"These are all security issues fixed in the libtasn1-4.9-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:10:09.642642Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2014:0594","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-13T08:52:54Z","modified":"2026-06-28T10:10:17Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0596","title":"Red Hat Security Advisory: libtasn1 security update","status":"published","published":"2024-09-13T08:52:49Z","modified":"2026-06-28T10:10:18Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0687","title":"Red Hat Security Advisory: libtasn1 security update","status":"published","published":"2024-09-13T08:53:29Z","modified":"2026-06-28T10:10:25Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0815","title":"Red Hat Security Advisory: rhev-hypervisor6 security update","status":"published","published":"2024-09-13T08:54:18Z","modified":"2026-06-28T10:10:38Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:0901-1","title":"Security update for libtasn1","description":"\nlibtasn1 has been updated to fix three security issues:\n\n    * asn1_get_bit_der() could have returned negative bit length\n      (CVE-2014-3468)\n    * Multiple boundary check issues could have allowed DoS (CVE-2014-3467)\n    * Possible DoS by NULL pointer dereference in asn1_read_value_type\n      (CVE-2014-3469)\n\nSecurity Issues:\n\n    * CVE-2014-3468\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468\u003e\n    * CVE-2014-3467\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467\u003e\n    * CVE-2014-3469\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469\u003e\n\n","status":"published","published":"2014-07-17T14:16:08Z","modified":"2026-02-04T04:18:54.845325Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2014-3468","description":"The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.","status":"published","published":"2014-06-05T00:00:00Z","modified":"2026-04-22T09:39:33.296093Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2294-1","title":"libtasn1-3, libtasn1-6 vulnerabilities","description":"It was discovered that Libtasn1 incorrectly handled certain ASN.1 data\nstructures. An attacker could exploit this with specially crafted ASN.1\ndata and cause applications using Libtasn1 to crash, resulting in a denial\nof service. (CVE-2014-3467)\n\nIt was discovered that Libtasn1 incorrectly handled negative bit lengths.\nAn attacker could exploit this with specially crafted ASN.1 data and cause\napplications using Libtasn1 to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2014-3468)\n\nIt was discovered that Libtasn1 incorrectly handled certain ASN.1 data. An\nattacker could exploit this with specially crafted ASN.1 data and cause\napplications using Libtasn1 to crash, resulting in a denial of service.\n(CVE-2014-3469)\n","status":"published","published":"2014-07-22T16:55:32Z","modified":"2026-04-22T08:58:10.932911Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}