Vulnerability Details CVE-2019-17362
In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 70.2%
CVSS Severity
CVSS v3 Score 9.1
CVSS v2 Score 6.4
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00041.html
- https://github.com/libtom/libtomcrypt/issues/507
- https://github.com/libtom/libtomcrypt/pull/508
- https://lists.debian.org/debian-lts-announce/2019/10/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/
- https://vuldb.com/?id.142995
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00041.html
- https://github.com/libtom/libtomcrypt/issues/507
- https://github.com/libtom/libtomcrypt/pull/508
- https://lists.debian.org/debian-lts-announce/2019/10/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/
- https://vuldb.com/?id.142995
Products affected by CVE-2019-17362
-
cpe:2.3:a:libtom:libtomcrypt:0.75
-
cpe:2.3:a:libtom:libtomcrypt:0.76
-
cpe:2.3:a:libtom:libtomcrypt:0.77
-
cpe:2.3:a:libtom:libtomcrypt:0.78
-
cpe:2.3:a:libtom:libtomcrypt:0.79
-
cpe:2.3:a:libtom:libtomcrypt:0.80
-
cpe:2.3:a:libtom:libtomcrypt:0.81
-
cpe:2.3:a:libtom:libtomcrypt:0.82
-
cpe:2.3:a:libtom:libtomcrypt:0.83
-
cpe:2.3:a:libtom:libtomcrypt:0.84
-
cpe:2.3:a:libtom:libtomcrypt:0.85
-
cpe:2.3:a:libtom:libtomcrypt:0.86
-
cpe:2.3:a:libtom:libtomcrypt:0.87
-
cpe:2.3:a:libtom:libtomcrypt:0.88
-
cpe:2.3:a:libtom:libtomcrypt:0.89
-
cpe:2.3:a:libtom:libtomcrypt:0.90
-
cpe:2.3:a:libtom:libtomcrypt:0.91
-
cpe:2.3:a:libtom:libtomcrypt:0.92
-
cpe:2.3:a:libtom:libtomcrypt:0.93
-
cpe:2.3:a:libtom:libtomcrypt:0.94
-
cpe:2.3:a:libtom:libtomcrypt:0.95
-
cpe:2.3:a:libtom:libtomcrypt:0.96
-
cpe:2.3:a:libtom:libtomcrypt:0.97
-
cpe:2.3:a:libtom:libtomcrypt:0.98
-
cpe:2.3:a:libtom:libtomcrypt:0.99
-
cpe:2.3:a:libtom:libtomcrypt:1.00
-
cpe:2.3:a:libtom:libtomcrypt:1.01
-
cpe:2.3:a:libtom:libtomcrypt:1.02
-
cpe:2.3:a:libtom:libtomcrypt:1.03
-
cpe:2.3:a:libtom:libtomcrypt:1.04
-
cpe:2.3:a:libtom:libtomcrypt:1.05
-
cpe:2.3:a:libtom:libtomcrypt:1.06
-
cpe:2.3:a:libtom:libtomcrypt:1.07
-
cpe:2.3:a:libtom:libtomcrypt:1.08
-
cpe:2.3:a:libtom:libtomcrypt:1.09
-
cpe:2.3:a:libtom:libtomcrypt:1.10
-
cpe:2.3:a:libtom:libtomcrypt:1.11
-
cpe:2.3:a:libtom:libtomcrypt:1.12
-
cpe:2.3:a:libtom:libtomcrypt:1.13
-
cpe:2.3:a:libtom:libtomcrypt:1.14
-
cpe:2.3:a:libtom:libtomcrypt:1.15
-
cpe:2.3:a:libtom:libtomcrypt:1.16
-
cpe:2.3:a:libtom:libtomcrypt:1.17
-
cpe:2.3:a:libtom:libtomcrypt:1.18.0
-
cpe:2.3:a:libtom:libtomcrypt:1.18.1
-
cpe:2.3:a:libtom:libtomcrypt:1.18.2
-
cpe:2.3:o:debian:debian_linux:8.0