CVE-2019-17362 Information disclosure in n/a
Attackers can cause denial of service or read sensitive memory via crafted DER data in LibTomCrypt due to improper UTF-8 validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-17362?
CVE-2019-17362 is a critical vulnerability in Debian Debian Linux, published on 9 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.
Weakness: CWE-125
Which versions are affected by CVE-2019-17362?
It affects 2 products.
Linux distribution packages (5)
libtomcrypt SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 1.17-3.3.1 |
libtomcrypt SUSE:Linux Enterprise Workstation Extension 12 SP4 | All versions | 1.17-3.3.1 |
libtomcrypt SUSE:Linux Enterprise Workstation Extension 12 SP5 | All versions | 1.17-3.3.1 |
libtomcrypt openSUSE:Leap 15.0 | All versions | 1.17-lp150.2.3.1 |
libtomcrypt openSUSE:Leap 15.1 | All versions | 1.17-lp151.3.3.1 |
Products include Debian Debian Linux, Libtom Libtomcrypt.
How do I fix CVE-2019-17362?
Apply the vendor's patch.
Is CVE-2019-17362 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-17362 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2019-17362, AZL-36958, AZL-7275, DEBIAN-CVE-2019-17362, DLA-1951-1, GHSA-x32c-6j92-4hp9 and 8 more.