1182 matches found
CVE-2019-14859
A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable...
UBUNTU-CVE-2019-14853
An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions or no exceptions at all, which could lead to a denial of service...
CVE-2019-14859
A flaw was found in python-ecdsa, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false...
CVE-2018-2603
It was discovered that the Libraries component of OpenJDK failed to sufficiently limit the amount of memory allocated when reading DER encoded input. A remote attacker could possibly use this flaw to make a Java application use an excessive amount of memory if it parsed attacker supplied DER...
Denial Of Service (DoS)
libtomcrypt.so is vulnerable to denial of service DoS. The attack is possible because it does not properly handle detection of invalid UTF-8 sequences in the function derdecodeutf8string when an malicious DER-encoded data, causing memory leaks...
Debian: Security Advisory (DLA-1951-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ALPINE-CVE-2019-17362
In LibTomCrypt through 1.18.2, the derdecodeutf8string function in derdecodeutf8string.c does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service out-of-bounds read and crash or read information from other memory locations via...
AZL-7275 CVE-2019-17362 affecting package libtomcrypt for versions less than 1.18.2-9
In LibTomCrypt through 1.18.2, the derdecodeutf8string function in derdecodeutf8string.c does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service out-of-bounds read and crash or read information from other memory locations via...
Out-of-bounds
In LibTomCrypt through 1.18.2, the derdecodeutf8string function in derdecodeutf8string.c does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service out-of-bounds read and crash or read information from other memory locations via...
CVE-2019-17362
In LibTomCrypt through 1.18.2, the derdecodeutf8string function in derdecodeutf8string.c does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service out-of-bounds read and crash or read information from other memory locations via...
CVE-2019-17362
In LibTomCrypt through 1.18.2, the derdecodeutf8string function in derdecodeutf8string.c does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service out-of-bounds read and crash or read information from other memory locations via...
LibTomCrypt Memory Corruption Vulnerability
LibTomCrypt is a fairly comprehensive modular portable encryption toolkit. LibTomCrypt 1.18.2 and earlier versions suffer from a memory corruption vulnerability that stems from the derdecodeutf8string function in derdecodeutf8string.c failing to correctly detect certain invalid UTF-8 sequences,...
CVE-2019-17362
In LibTomCrypt through 1.18.2, the derdecodeutf8string function in derdecodeutf8string.c does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service out-of-bounds read and crash or read information from other memory locations via...
PT-2019-4890
Name of the Vulnerable Software and Affected Versions python-ecdsa versions prior to 0.13.3 Description A flaw was found in the python-ecdsa library where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making t...
PT-2019-4889
Name of the Vulnerable Software and Affected Versions python-ecdsa versions 0.5 through 0.13.2 Description A flaw in the error-handling mechanism of python-ecdsa could lead to a denial of service when decoding malformed DER signatures. This issue may cause unexpected exceptions or no exceptions a...
security/py-ecdsa -- multiple issues
py-ecdsa developers report: Fix CVE-2019-14853 - possible DoS caused by malformed signature decoding. Fix CVE-2019-14859 - signature malleability caused by insufficient checks of DER encoding...
CVE-2019-14853
An error-handling flaw was found in python-ecdsa. During signature decoding, malformed DER signatures could raise unexpected exceptions or no exceptions at all, which could lead to a denial of service...
wolfSSL Buffer Over-Read Vulnerability
wolfSSL is a small, portable, embedded SSL/TLS library intended for use by embedded systems developers. A buffer over-read vulnerability exists in DecodeCertExtensions in wolfcrypt/src/asn.c in wolfSSL 4.1.0, which stems from an ASNBOOLEAN byte read handling error in GetLengthex, and can be...
CVE-2019-15651
wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASNBOOLEAN byte is mishandled for a crafted DER certificate in GetLengthex...