67 matches found
Buffer overflow
tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the needbytes value is mismanaged...
CVE-2019-8981
CVE-2019-8981 affects the axTLS library (tls1.c) prior to version 2.1.5. The root cause is a mismanagement of the need_bytes value, leading to a buffer overflow when processing crafted TLS packets. Documented impact is a buffer overflow; exploitation details are not provided in the connected docu...
CVE-2019-8981
tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the needbytes value is mismanaged...
CVE-2018-16150
In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not reject excess data after the hash value. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...
Code injection
In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...
CVE-2018-16253
In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...
CVE-2018-16149
In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure. Consequently, when small public exponents are being used, a remote attacker can generate purposefully crafted signatures and put them on X.50...
Code injection
In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure. Consequently, when small public exponents are being used, a remote attacker can generate purposefully crafted signatures and put them on X.50...
Code injection
In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not reject excess data after the hash value. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...
CVE-2018-16253
In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...
CVE-2018-16253
In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...
CVE-2018-16253
CVE-2018-16253 describes a flaw in axTLS 2.1.3 and earlier where PKCS#1 v1.5 signature verification in sig_verify() of x509.c does not properly verify ASN.1 metadata, enabling a remote attacker to forge signatures under small public exponents and impersonate via fake X.509 certificates. The issue...
CVE-2018-16149
Removed by vendor...
CVE-2018-16150
In axTLS 2.1.3 and earlier, the PKCS#1 v1.5 signature verification in sig_verify() fails to reject excess data after the hash, enabling signature forgery when small public exponents are used. This can lead to impersonation via forged X.509 certificates. This CVE-2018-16150 is a variant of CVE-200...
CVE-2018-16150
In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not reject excess data after the hash value. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...
CVE-2018-16149
axTLS vulnerability CVE-2018-16149 affects version 2.1.3 and earlier, where sig_verify() in x509.c blindly trusts ASN.1 declared lengths in PKCS#1 v1.5 signatures. When small public exponents are used, a remote attacker can create crafted signatures on X.509 certificates that trigger illegal memo...
Design/Logic Flaw
axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year 1950 of UTCTime being misinterpreted as 2050...
CVE-2017-1000416
axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year 1950 of UTCTime being misinterpreted as 2050...