You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa libtasn1

Sigurnosni nedostaci programskog paketa libtasn1

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LMV

Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2014:107

Package : libtasn1
Date : June 9, 2014
Affected: Business Server 1.0, Enterprise Server 5.0

Problem Description:

Updated libtasn1 packages fix security vulnerabilities:

Multiple buffer boundary check issues were discovered in libtasn1
library, causing it to read beyond the boundary of an allocated buffer.
An untrusted ASN.1 input could cause an application using the library
to crash (CVE-2014-3467).

It was discovered that libtasn1 library function asn1_get_bit_der()
could incorrectly report negative bit length of the value read from
ASN.1 input. This could possibly lead to an out of bounds access in
an application using libtasn1, for example in case if application
tried to terminate read value with NUL byte (CVE-2014-3468).

A NULL pointer dereference flaw was found in libtasn1's
asn1_read_value_type() / asn1_read_value() function. If an application
called the function with a NULL value for an ivalue argument to
determine the amount of memory needed to store data to be read from
the ASN.1 input, libtasn1 could incorrectly attempt to dereference
the NULL pointer, causing an application using the library to crash

The packages for mes5 have been patched to correct these issues and
the packages for mbs1 have been upgraded to the 3.6 version where
these issues has been fixed.


Updated Packages:

Mandriva Enterprise Server 5:
add1919dbd2a76f2afea69ec5b1ac4aa mes5/i586/libtasn1_3-1.5-2.2mdvmes5.2.i586.rpm
6f9d6496e709d28388fba42b36ba03bb mes5/i586/libtasn1-devel-1.5-2.2mdvmes5.2.i586.rpm
bd5bee278b0bf78f0cc5c4804912db49 mes5/i586/libtasn1-tools-1.5-2.2mdvmes5.2.i586.rpm
8a020997dbaae6ab4796a44a93a00da3 mes5/SRPMS/libtasn1-1.5-2.2mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
d3ad6c9991e31c780bfd8f518c6f3c20 mes5/x86_64/lib64tasn1_3-1.5-2.2mdvmes5.2.x86_64.rpm
227253880eb5046d549a7a46483394b4 mes5/x86_64/lib64tasn1-devel-1.5-2.2mdvmes5.2.x86_64.rpm
da82e349ee924a3306ffb03730557438 mes5/x86_64/libtasn1-tools-1.5-2.2mdvmes5.2.x86_64.rpm
8a020997dbaae6ab4796a44a93a00da3 mes5/SRPMS/libtasn1-1.5-2.2mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
46535ab567d7ded71f9e18d8eabd3256 mbs1/x86_64/lib64tasn1_6-3.6-1.3.mbs1.x86_64.rpm
e49f8229aaacd8f678366c163b9fa357 mbs1/x86_64/lib64tasn1-devel-3.6-1.3.mbs1.x86_64.rpm
a07b7cf179a799d3a77e62d0e27857d2 mbs1/x86_64/libtasn1-tools-3.6-1.3.mbs1.x86_64.rpm
bcca682662591cfc74148435ed2f5cb0 mbs1/SRPMS/libtasn1-3.6-1.3.mbs1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver 0x22458A98

You can view other update advisories for Mandriva Linux at:

If you want to report vulnerabilities, please contact


Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.4.12 (GNU/Linux)


To unsubscribe, send a email to
with this subject : unsubscribe security-announce
Want to buy your Pack or Services from Mandriva?
Go to

AutorMarko Stanec
Cert idNCERT-REF-2014-06-0071-ADV
More in Preporuke
Sigurnosni nedostaci programskog paketa gnutls

Otkriveni su sigurnosni nedostaci u programskom paketu gnutls za operacijski sustav Mandriva. Otkriveni nedostatak potencijalnim napadačima omogućuje prekid izvršavanja programskog...