Bug#867398: libtasn1-6: CVE-2017-10790

[Salvatore Bonaccorso]

Source: libtasn1-6
Version: 4.2-1
Severity: normal
Tags: security upstream

Hi,

the following vulnerability was published for libtasn1-6, filling the
bug to track the issue, but the impact is disputable.

CVE-2017-10790[0]:
| The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes
| a NULL pointer dereference and crash when reading crafted input that
| triggers assignment of a NULL value within an asn1_node structure. It
| may lead to a remote denial of service attack.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-10790
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10790
[1] https://bugzilla.novell.com/show_bug.cgi?id=1047002
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1464141

Regards,
Salvatore