The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade gnutlsUpgrade gnutls-develUpgrade libtasn1Upgrade libtasn1-toolsUpgrade gnutls-utilsUpgrade libtasn1-devel | Dec 1, 2016 | Mar 26, 2012 |
| Freebsd | — | Upgrade gnutlsUpgrade gnutls-develUpgrade libtasn1 | Dec 10, 2025 | Mar 21, 2012 |
| Gentoo Linux | — | Upgrade dev-libs/libtasn1. | Oct 30, 2017 | Mar 26, 2012 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Mar 26, 2012 |
| Oracle_linux | — | Upgrade libtasn1-toolsUpgrade libtasn1Upgrade libtasn1-devel | Oct 16, 2024 | Mar 26, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 19, 2012 |
| Suse | — | Upgrade libgnutlsxx-develUpgrade libgnutls30-32bitUpgrade libgnutls26-x86Upgrade libgnutls-dane0Upgrade libgnutls26Upgrade libgnutlsxx28Upgrade gnutlsUpgrade libgnutls-openssl-develUpgrade libgnutls-extra26Upgrade libgnutls30Upgrade libgnutls-extra-develUpgrade libgnutls-openssl27Upgrade libgnutlsxx30Upgrade libgnutls26-32bitUpgrade libgnutls28Upgrade libgnutls28-32bitUpgrade libgnutls-develUpgrade libgnutls-devel-doc | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libtasn1-3 | Nov 8, 2024 | Mar 26, 2012 |
| Vmsa 2012 0013 | — | Upgrade VMware ESX 4.1 to build number 800380Upgrade VMware ESX 4.0 to build number 787047 | Sep 17, 2012 | Mar 26, 2012 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub