PT-2019-15104 · Libtomcrypt+3 · Libtomcrypt+3

Luigi Coniglio + 1 · Published 2019-10-03 · Updated 2025-06-11 · CVE-2019-17362

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions LibTomCrypt versions 1.18.2 and earlier

Description The issue arises from the der decode utf8 string function not properly detecting certain invalid UTF-8 sequences. This allows attackers to cause a denial of service, such as an out-of-bounds read and crash, or to read information from other memory locations via carefully crafted DER-encoded data.

Recommendations For LibTomCrypt versions 1.18.2 and earlier, update to a version later than 1.18.2 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2020-3466

ALT-PU-2020-3486

ALT-PU-2023-8082

AZL-36958

AZL-7275

BDU:2025-16070

CVE-2019-17362

DLA-1951-1

MGASA-2020-0028

OESA-2021-1029

OPENSUSE-SU-2019:2454-1

OPENSUSE-SU-2019:2514-1

OPENSUSE-SU-2019_2454-1

OPENSUSE-SU-2019_2514-1

SUSE-SU-2019:2808-1

SUSE-SU-2019:3095-1

SUSE-SU-2019_2808-1

SUSE-SU-2019_3095-1

USN-4868-1

Affected Products

Alt Linux

Libtomcrypt

Suse

Ubuntu

References · 47

• 🔥 https://github.com/libtom/libtomcrypt/issues/507 · Exploit
• https://github.com/libtom/libtomcrypt/pull/508 · Patch
• https://osv.dev/vulnerability/AZL-36958 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE47 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17362 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-17362 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:2514-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4868-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0028 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1029 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0028.html · Security Note