CVE-2012-1569
published 2012-03-26CVE-2012-1569: The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle…
PriorityP425medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
4.46%
90.4th percentile
The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
Affected
221 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | gnutls | <= 3.0.15 | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
| gnu | gnutls | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jcv4-2hjq-vv2c: The asn1_get_length_der function in decoding
ghsa_unreviewed·2022-05-14
CVE-2012-1569 [MEDIUM] GHSA-jcv4-2hjq-vv2c: The asn1_get_length_der function in decoding
The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
Ubuntu
Libtasn1 vulnerability
vendor_ubuntu·2012-05-02
CVE-2012-1569 Libtasn1 vulnerability
Title: Libtasn1 vulnerability
Summary: Libtasn1 could be made to crash or run programs as your login if it
received specially crafted input.
Matthew Hall discovered that Libtasn1 incorrectly handled certain large
values. An attacker could exploit this with a specially crafted ASN.1
structure and cause a denial of service, or possibly execute arbitrary
code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
libtasn1: DER decoding buffer overflow (GNUTLS-SA-2012-3, MU-201202-02)
vendor_redhat·2012-03-19·CVSS 5.0
CVE-2012-1569 [MEDIUM] libtasn1: DER decoding buffer overflow (GNUTLS-SA-2012-3, MU-201202-02)
libtasn1: DER decoding buffer overflow (GNUTLS-SA-2012-3, MU-201202-02)
The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
Package: gnutls (Red Hat Enterprise Linux 4) - Will not fix
Package: mingw32-gnutls (Red Hat Enterprise Linux 6) - Will not fix
Package: libtasn1 (Red Hat Enterprise Linux 7) - Not affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-1569 mingw32-gnutls: libtasn1: DER decoding buffer overflow [fedora-all]
bugzilla·2012-03-21·CVSS 5.0
CVE-2012-1569 [MEDIUM] CVE-2012-1569 mingw32-gnutls: libtasn1: DER decoding buffer overflow [fedora-all]
CVE-2012-1569 mingw32-gnutls: libtasn1: DER decoding buffer overflow [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=se
Bugzilla
CVE-2012-1569 libtasn1: DER decoding buffer overflow (GNUTLS-SA-2012-3, MU-201202-02)
bugzilla·2012-03-20·CVSS 5.0
CVE-2012-1569 [MEDIUM] CVE-2012-1569 libtasn1: DER decoding buffer overflow (GNUTLS-SA-2012-3, MU-201202-02)
CVE-2012-1569 libtasn1: DER decoding buffer overflow (GNUTLS-SA-2012-3, MU-201202-02)
libtasn1 version 2.12 was released fixing the following issue:
- Corrected DER decoding issue (reported by Matthew Hall).
Added self check to detect the problem, see tests/Test_overflow.c.
This problem can lead to at least remotely triggered crashes, see
further analysis on the libtasn1 mailing list.
http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/53
Upstream and few limited details are available at:
http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/54
The behavior of asn1_get_length_der was changed to protect against accidental incorrect use, if though it was previously "working properly and as documented".
Discussion:
Upstream test case:
http://git.savannah.gnu.org/cgit/libtasn1.gi
arXiv
Vital: Vulnerability-Oriented Symbolic Execution via Type-Unsafe Pointer-Guided Monte Carlo Tree Search
arxiv_fulltext·2025-12-12
Vital: Vulnerability-Oriented Symbolic Execution via Type-Unsafe Pointer-Guided Monte Carlo Tree Search
: Vulnerability-Oriented Symbolic Execution via Type-Unsafe Pointer-Guided Monte Carlo Tree Search
Haoxin Tu
Partial work was done when Haoxin was visiting the MPI Software Security Group led by Prof. Marcel Böhme.
Singapore Management University
Singapore
[email protected]
Lingxiao Jiang
Singapore Management University
Singapore
[email protected]
Marcel Böhme
Max Planck Institute for Security and Privacy
Germany
[email protected]
Haoxin Tu, Lingxiao Jiang, and Marcel Böhme
## Abstract
How do we find new memory safety bugs effectively when navigating a symbolic execution tree that suffers from the well-known path explosion challenge?
Existing solutions either adopt path search heuristics to maximize coverage rate or chopped symbolic execution to skip uninteresting code
http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.htmlhttp://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5932http://article.gmane.org/gmane.comp.gnu.libtasn1.general/53http://article.gmane.org/gmane.comp.gnu.libtasn1.general/54http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/http://linux.oracle.com/errata/ELSA-2014-0596.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/076856.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/076865.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/077284.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/077339.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/078207.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-March/076699.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0427.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0488.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0531.htmlhttp://secunia.com/advisories/48397http://secunia.com/advisories/48488http://secunia.com/advisories/48505http://secunia.com/advisories/48578http://secunia.com/advisories/48596http://secunia.com/advisories/49002http://secunia.com/advisories/50739http://secunia.com/advisories/57260http://www.debian.org/security/2012/dsa-2440http://www.gnu.org/software/gnutls/security.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2012:039http://www.openwall.com/lists/oss-security/2012/03/20/3http://www.openwall.com/lists/oss-security/2012/03/20/8http://www.openwall.com/lists/oss-security/2012/03/21/5http://www.securitytracker.com/id?1026829http://www.ubuntu.com/usn/USN-1436-1https://bugzilla.redhat.com/show_bug.cgi?id=804920http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.htmlhttp://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5932http://article.gmane.org/gmane.comp.gnu.libtasn1.general/53http://article.gmane.org/gmane.comp.gnu.libtasn1.general/54http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/http://linux.oracle.com/errata/ELSA-2014-0596.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/076856.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/076865.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/077284.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/077339.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/078207.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-March/076699.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0427.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0488.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0531.htmlhttp://secunia.com/advisories/48397http://secunia.com/advisories/48488http://secunia.com/advisories/48505http://secunia.com/advisories/48578http://secunia.com/advisories/48596http://secunia.com/advisories/49002http://secunia.com/advisories/50739http://secunia.com/advisories/57260http://www.debian.org/security/2012/dsa-2440http://www.gnu.org/software/gnutls/security.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2012:039http://www.openwall.com/lists/oss-security/2012/03/20/3http://www.openwall.com/lists/oss-security/2012/03/20/8http://www.openwall.com/lists/oss-security/2012/03/21/5http://www.securitytracker.com/id?1026829http://www.ubuntu.com/usn/USN-1436-1https://bugzilla.redhat.com/show_bug.cgi?id=804920
2012-03-26
Published