Buffer overflow

tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the needbytes value is mismanaged...

CVE-2019-8981

CVE-2019-8981 affects the axTLS library (tls1.c) prior to version 2.1.5. The root cause is a mismanagement of the need_bytes value, leading to a buffer overflow when processing crafted TLS packets. Documented impact is a buffer overflow; exploitation details are not provided in the connected docu...

CVE-2019-8981

tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the needbytes value is mismanaged...

CVE-2018-16150

In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not reject excess data after the hash value. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...

CVE-2018-16253

In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...

Code injection

In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...

CVE-2018-16149

In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure. Consequently, when small public exponents are being used, a remote attacker can generate purposefully crafted signatures and put them on X.50...

Code injection

In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not reject excess data after the hash value. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...

Code injection

In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification blindly trusts the declared lengths in the ASN.1 structure. Consequently, when small public exponents are being used, a remote attacker can generate purposefully crafted signatures and put them on X.50...

CVE-2018-16253

In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...

CVE-2018-16253

In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...

CVE-2018-16253

CVE-2018-16253 describes a flaw in axTLS 2.1.3 and earlier where PKCS#1 v1.5 signature verification in sig_verify() of x509.c does not properly verify ASN.1 metadata, enabling a remote attacker to forge signatures under small public exponents and impersonate via fake X.509 certificates. The issue...

CVE-2018-16149

Removed by vendor...

CVE-2018-16149

axTLS vulnerability CVE-2018-16149 affects version 2.1.3 and earlier, where sig_verify() in x509.c blindly trusts ASN.1 declared lengths in PKCS#1 v1.5 signatures. When small public exponents are used, a remote attacker can create crafted signatures on X.509 certificates that trigger illegal memo...

CVE-2018-16150

In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not reject excess data after the hash value. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...

CVE-2018-16150

In axTLS 2.1.3 and earlier, the PKCS#1 v1.5 signature verification in sig_verify() fails to reject excess data after the hash, enabling signature forgery when small public exponents are used. This can lead to impersonation via forged X.509 certificates. This CVE-2018-16150 is a variant of CVE-200...

Design/Logic Flaw

axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year 1950 of UTCTime being misinterpreted as 2050...

CVE-2017-1000416

axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year 1950 of UTCTime being misinterpreted as 2050...

CVE-2017-1000416

axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year 1950 of UTCTime being misinterpreted as 2050...

CVE-2017-1000416

CVE-2017-1000416 concerns axTLS 1.5.3, where a coding error in the ASN.1 parser causes the UTCTime year (19)50 to be misinterpreted as 2050. The available sources describe the issue and its manifestation but do not specify affected products beyond axTLS 1.5.3, nor provide remediation steps or exp...