CVE-2015-2806 Memory corruption in n/a

Critical 10.0 Published 10 Apr 2015 Updated 6 Aug 2024

Remote attackers can exploit a stack-based buffer overflow in libtasn1 to potentially execute arbitrary code or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2015-2806?

CVE-2015-2806 is a critical memory corruption vulnerability in Canonical Ubuntu Linux, published on 10 Apr 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.

Weakness: CWE-119

Which versions are affected by CVE-2015-2806?

It affects 4 products.

Linux distribution packages (4)

`libtasn1` SUSE:Linux Enterprise Desktop 12	All versions	`3.7-4.1`
`libtasn1` SUSE:Linux Enterprise Server 12	All versions	`3.7-4.1`
`libtasn1` SUSE:Linux Enterprise Server for SAP Applications 12	All versions	`3.7-4.1`
`libtasn1` SUSE:Linux Enterprise Software Development Kit 12	All versions	`3.7-4.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Gnu Libtasn1.

How do I fix CVE-2015-2806?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2015-2806 being exploited?

There is no known exploitation of CVE-2015-2806 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2015-2806, DLA-195-1, DSA-3220-1, GHSA-72cq-2586-ch4w, MGASA-2015-0128, SUSE-SU-2015:0904-1 and 2 more.