PT-2019-15104 · Libtomcrypt+3 · Libtomcrypt+3

Luigi Coniglio + 1 · Publicado 2019-10-03 · Atualizado 2025-06-11 · CVE-2019-17362

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibTomCrypt versions 1.18.2 and earlier

Description The issue arises from the der decode utf8 string function not properly detecting certain invalid UTF-8 sequences. This allows attackers to cause a denial of service, such as an out-of-bounds read and crash, or to read information from other memory locations via carefully crafted DER-encoded data.

Recommendations For LibTomCrypt versions 1.18.2 and earlier, update to a version later than 1.18.2 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Exploit

Correção

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2020-3466

ALT-PU-2020-3486

ALT-PU-2023-8082

AZL-36958

AZL-7275

BDU:2025-16070

CVE-2019-17362

DLA-1951-1

MGASA-2020-0028

OESA-2021-1029

OPENSUSE-SU-2019:2454-1

OPENSUSE-SU-2019:2514-1

OPENSUSE-SU-2019_2454-1

OPENSUSE-SU-2019_2514-1

SUSE-SU-2019:2808-1

SUSE-SU-2019:3095-1

SUSE-SU-2019_2808-1

SUSE-SU-2019_3095-1

USN-4868-1

Produtos afetados

Alt Linux

Libtomcrypt

Suse

Ubuntu

Referências · 47

• 🔥 https://github.com/libtom/libtomcrypt/issues/507 · Exploit
• https://github.com/libtom/libtomcrypt/pull/508 · Correção
• https://github.com/libtom/libtomcrypt/commit/25c26a3b7a9ad8192ccc923e15cf62bf0108ef94 · Nota
• https://osv.dev/vulnerability/AZL-36958 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE47 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-17362 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-17362 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-17362 · Nota de Segurança
• https://lists.opensuse.org/archives/list/[e-mail]/thread/GKJSBZBZEYMM65TFRPRHDO2WY4SXZUYR/#GKJSBZBZEYMM65TFRPRHDO2WY4SXZUYR · Nota
• https://cve.org/CVERecord?id=CVE-2019-17362 · Nota de Segurança
• https://abf.rosa.ru/advisories/ROSA-SA-2026-3173 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2019:2514-1 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-4868-1 · Aviso do Fabricante