Vulnerability Description
In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libtom | Libtomcrypt | <= 1.18.2 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00041.html
- https://github.com/libtom/libtomcrypt/issues/507ExploitThird Party Advisory
- https://github.com/libtom/libtomcrypt/pull/508PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00010.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://vuldb.com/?id.142995Permissions Required
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00041.html
- https://github.com/libtom/libtomcrypt/issues/507ExploitThird Party Advisory
- https://github.com/libtom/libtomcrypt/pull/508PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/10/msg00010.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2019-17362?
CVE-2019-17362 is a vulnerability with a CVSS score of 9.1 (CRITICAL). In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to ca...
How severe is CVE-2019-17362?
CVE-2019-17362 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-17362?
Check the references section above for vendor advisories and patch information. Affected products include: Libtom Libtomcrypt, Debian Debian Linux.