NULL pointer dereference in Gnu Gnutls
CVE-2014-3469
The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument.
EPSS: 0.045 (89.4th percentile) — read the EPSS interpretation.
Affected products
- Gnu Gnutls
- Gnu Libtasn1
- Debian Debian_linux — versions 7.0
- Redhat Enterprise_linux_desktop — versions 5.0, 6.0, 7.0
- Redhat Enterprise_linux_eus — versions 6.5, 7.3, 7.4
- Redhat Enterprise_linux_server — versions 5.0, 6.0, 7.0
- Redhat Enterprise_linux_server_aus — versions 6.5, 7.3, 7.4
- Redhat Enterprise_linux_server_tus — versions 6.5, 7.3, 7.6
- Redhat Enterprise_linux_workstation — versions 5.0, 6.0, 7.0
- Redhat Virtualization — versions 6.0
Weakness classification (CWE)
References
- 60320 (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- DSA-3056 (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- 59057 (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- SUSE-SU-2014:0758 (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- MDVSA-2015:116 (vendor-advisory, Third Party Advisory, x_refsource_MANDRIVA)
- 59021 (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- 61888 (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)