The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
CVSS Details
- CVSS 3.1 Base Score: 4.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libtasn1-develUpgrade libtasn1Upgrade gnutls-utilsUpgrade libtasn1-toolsUpgrade gnutls-develUpgrade gnutls | Dec 1, 2016 | Mar 26, 2012 |
| Freebsd | — | Upgrade libtasn1Upgrade gnutls-develUpgrade gnutls | Dec 10, 2025 | Mar 21, 2012 |
| Gentoo Linux | — | Upgrade dev-libs/libtasn1. | Oct 30, 2017 | Mar 26, 2012 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Mar 26, 2012 |
| Oracle_linux | — | Upgrade libtasn1-toolsUpgrade libtasn1-develUpgrade libtasn1 | Oct 16, 2024 | Mar 26, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 19, 2012 |
| Suse | — | Upgrade libgnutls28-32bitUpgrade libgnutls-extra28Upgrade gnutls-32bitUpgrade libgnutlsxx28-debuginfoUpgrade libgnutls-openssl27Upgrade libgnutls-develUpgrade libgnutls-openssl27-debuginfoUpgrade libgnutls-devel-32bitUpgrade gnutls-develUpgrade libgnutls28Upgrade gnutls-devel-32bitUpgrade libgnutls-extra28-debuginfoUpgrade libgnutlsxx-develUpgrade libgnutls28-debuginfo-32bitUpgrade libgnutls28-x86Upgrade gnutls-debugsourceUpgrade gnutls-64bitUpgrade libgnutls-extra-develUpgrade libgnutls-openssl-develUpgrade gnutls-x86Upgrade libgnutls28-debuginfo-x86Upgrade gnutlsUpgrade libgnutlsxx28Upgrade libgnutls28-debuginfoUpgrade gnutls-devel-64bitUpgrade gnutls-debuginfo | Dec 12, 2013 | Mar 26, 2012 |
| Ubuntu | — | Upgrade libtasn1-3 | Nov 8, 2024 | Mar 26, 2012 |
| Vmsa 2012 0013 | — | Upgrade VMware ESX 4.1 to build number 800380Upgrade VMware ESX 4.0 to build number 787047 | Sep 17, 2012 | Mar 26, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub