openSUSE-SU-2019:2454

openSUSE-SU-2019:2514

https://github.com/libtom/libtomcrypt/issues/507

https://github.com/libtom/libtomcrypt/pull/508

[debian-lts-announce] 20191009 [SECURITY] [DLA 1951-1] libtomcrypt security update

https://vuldb.com/?id.142995

According to the versions of the libtomcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not     properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial     of service (out-of-bounds read and crash) or read information from other memory locations via carefully     crafted DER-encoded data. (CVE-2019-17362)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libtomcrypt package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In LibTomCrypt through 1.18.2, the     der_decode_utf8_string function (in     der_decode_utf8_string.c) does not properly detect     certain invalid UTF-8 sequences. This allows     context-dependent attackers to cause a denial of     service (out-of-bounds read and crash) or read     information from other memory locations via carefully     crafted DER-encoded data.(CVE-2019-17362)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libtomcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In LibTomCrypt through 1.18.2, the     der_decode_utf8_string function (in     der_decode_utf8_string.c) does not properly detect     certain invalid UTF-8 sequences. This allows     context-dependent attackers to cause a denial of     service (out-of-bounds read and crash) or read     information from other memory locations via carefully     crafted DER-encoded data.(CVE-2019-17362)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libtomcrypt fixes the following issues :

CVE-2019-17362: Fixed an improper detection of invalid UTF-8 sequences that could have led to DoS or information disclosure via crafted DER-encoded data (bsc#1153433).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libtomcrypt fixes the following issue :

CVE-2019-17362: Fixed an improper detection of invalid UTF-8 sequences that could have led to DoS or information disclosure via crafted DER-encoded data (bsc#1153433).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libtomcrypt fixes the following issue :

  - CVE-2019-17362: Fixed an improper detection of invalid     UTF-8 sequences that could have led to DoS or     information disclosure via crafted DER-encoded data     (bsc#1153433).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a denial of service vulnerability in the libtomcrypt cryptographic library.

An out-of-bounds read and crash could occur via carefully-crafted 'DER' encoded data (eg. by importing an X.509 certificate).

For Debian 8 'Jessie', this issue has been fixed in libtomcrypt version 1.17-6+deb8u1.

We recommend that you upgrade your libtomcrypt packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
158007	EulerOS Virtualization 3.0.6.0 : libtomcrypt (EulerOS-SA-2022-1079)	Nessus	Huawei Local Security Checks	critical
152319	EulerOS 2.0 SP9 : libtomcrypt (EulerOS-SA-2021-2247)	Nessus	Huawei Local Security Checks	critical
152317	EulerOS 2.0 SP9 : libtomcrypt (EulerOS-SA-2021-2273)	Nessus	Huawei Local Security Checks	critical
152283	EulerOS 2.0 SP8 : libtomcrypt (EulerOS-SA-2021-2303)	Nessus	Huawei Local Security Checks	critical
151545	EulerOS Virtualization 2.9.0 : libtomcrypt (EulerOS-SA-2021-2196)	Nessus	Huawei Local Security Checks	critical
151536	EulerOS Virtualization 2.9.1 : libtomcrypt (EulerOS-SA-2021-2181)	Nessus	Huawei Local Security Checks	critical
131556	SUSE SLED12 Security Update : libtomcrypt (SUSE-SU-2019:3095-1)	Nessus	SuSE Local Security Checks	critical
131065	openSUSE Security Update : libtomcrypt (openSUSE-2019-2514)	Nessus	SuSE Local Security Checks	critical
130887	openSUSE Security Update : libtomcrypt (openSUSE-2019-2454)	Nessus	SuSE Local Security Checks	critical
130389	SUSE SLED15 / SLES15 Security Update : libtomcrypt (SUSE-SU-2019:2808-1)	Nessus	SuSE Local Security Checks	critical
129765	Debian DLA-1951-1 : libtomcrypt security update	Nessus	Debian Local Security Checks	critical

CVE-2019-17362

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical