In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1f0ac1260e advisory.

  - In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not     properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial     of service (out-of-bounds read and crash) or read information from other memory locations via carefully     crafted DER-encoded data. (CVE-2019-17362)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-b4b9b38f23 advisory.

  - In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not     properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial     of service (out-of-bounds read and crash) or read information from other memory locations via carefully     crafted DER-encoded data. (CVE-2019-17362)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4868-1 advisory.

  - In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not     properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial     of service (out-of-bounds read and crash) or read information from other memory locations via carefully     crafted DER-encoded data. (CVE-2019-17362)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libtomcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not     properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial     of service (out-of-bounds read and crash) or read information from other memory locations via carefully     crafted DER-encoded data. (CVE-2019-17362)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libtomcrypt package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In LibTomCrypt through 1.18.2, the     der_decode_utf8_string function (in     der_decode_utf8_string.c) does not properly detect     certain invalid UTF-8 sequences. This allows     context-dependent attackers to cause a denial of     service (out-of-bounds read and crash) or read     information from other memory locations via carefully     crafted DER-encoded data.(CVE-2019-17362)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libtomcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In LibTomCrypt through 1.18.2, the     der_decode_utf8_string function (in     der_decode_utf8_string.c) does not properly detect     certain invalid UTF-8 sequences. This allows     context-dependent attackers to cause a denial of     service (out-of-bounds read and crash) or read     information from other memory locations via carefully     crafted DER-encoded data.(CVE-2019-17362)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libtomcrypt fixes the following issues :

CVE-2019-17362: Fixed an improper detection of invalid UTF-8 sequences that could have led to DoS or information disclosure via crafted DER-encoded data (bsc#1153433).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libtomcrypt fixes the following issue :

CVE-2019-17362: Fixed an improper detection of invalid UTF-8 sequences that could have led to DoS or information disclosure via crafted DER-encoded data (bsc#1153433).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libtomcrypt fixes the following issue :

  - CVE-2019-17362: Fixed an improper detection of invalid     UTF-8 sequences that could have led to DoS or     information disclosure via crafted DER-encoded data     (bsc#1153433).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a denial of service vulnerability in the libtomcrypt cryptographic library.

An out-of-bounds read and crash could occur via carefully-crafted 'DER' encoded data (eg. by importing an X.509 certificate).

For Debian 8 'Jessie', this issue has been fixed in libtomcrypt version 1.17-6+deb8u1.

We recommend that you upgrade your libtomcrypt packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
186895	Fedora 39 : perl-CryptX (2023-1f0ac1260e)	Nessus	Fedora Local Security Checks	critical
186891	Fedora 38 : perl-CryptX (2023-b4b9b38f23)	Nessus	Fedora Local Security Checks	critical
183103	Ubuntu 16.04 ESM / 18.04 ESM : LibTomCrypt vulnerability (USN-4868-1)	Nessus	Ubuntu Local Security Checks	critical
158007	EulerOS Virtualization 3.0.6.0 : libtomcrypt (EulerOS-SA-2022-1079)	Nessus	Huawei Local Security Checks	critical
152319	EulerOS 2.0 SP9 : libtomcrypt (EulerOS-SA-2021-2247)	Nessus	Huawei Local Security Checks	critical
152317	EulerOS 2.0 SP9 : libtomcrypt (EulerOS-SA-2021-2273)	Nessus	Huawei Local Security Checks	critical
152283	EulerOS 2.0 SP8 : libtomcrypt (EulerOS-SA-2021-2303)	Nessus	Huawei Local Security Checks	critical
151545	EulerOS Virtualization 2.9.0 : libtomcrypt (EulerOS-SA-2021-2196)	Nessus	Huawei Local Security Checks	critical
151536	EulerOS Virtualization 2.9.1 : libtomcrypt (EulerOS-SA-2021-2181)	Nessus	Huawei Local Security Checks	critical
131556	SUSE SLED12 Security Update : libtomcrypt (SUSE-SU-2019:3095-1)	Nessus	SuSE Local Security Checks	critical
131065	openSUSE Security Update : libtomcrypt (openSUSE-2019-2514)	Nessus	SuSE Local Security Checks	critical
130887	openSUSE Security Update : libtomcrypt (openSUSE-2019-2454)	Nessus	SuSE Local Security Checks	critical
130389	SUSE SLED15 / SLES15 Security Update : libtomcrypt (SUSE-SU-2019:2808-1)	Nessus	SuSE Local Security Checks	critical
129765	Debian DLA-1951-1 : libtomcrypt security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-17362

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical