CVE-2015-3622

2015-05-1219:59:24

CWE-119

mitre

web.nvd.nist.gov

cve-2015-3622

information security

remote attackers

denial of service

out-of-bounds heap read

crafted certificate

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

AI Score

6.7

Confidence

High

EPSS

0.924

Percentile

99.0%

JSON

The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.

Affected configurations

Nvd

Node

opensuseopensuseMatch13.2

Node

fedoraprojectfedoraMatch21

Node

gnulibtasn1Range≤4.4

VendorProductVersionCPE
opensuseopensuse13.2cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
fedoraprojectfedora21cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
gnulibtasn1*cpe:2.3:a:gnu:libtasn1:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
opensuse	opensuse	13.2	cpe:2.3:o:opensuse:opensuse:13.2:::::::*
fedoraproject	fedora	21	cpe:2.3:o:fedoraproject:fedora:21:::::::*
gnu	libtasn1	*	cpe:2.3:a:gnu:libtasn1::::::::