CVE-2014-3468

The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.

• CWE-131

• http://advisories.mageia.org/MGASA-2014-0247.htmlThird Party Advisory
• http://git.savannah.gnu.org/cgit/libtasn1.git/commit/?id=1c3ccb3e040bf13e342ee60bc23b21b97b11923fPatch, Vendor Advisory
• http://linux.oracle.com/errata/ELSA-2014-0594.htmlThird Party Advisory
• http://linux.oracle.com/errata/ELSA-2014-0596.htmlThird Party Advisory
• http://lists.gnu.org/archive/html/help-libtasn1/2014-05/msg00006.htmlMailing List, Patch, Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00002.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00015.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0594.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0596.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0687.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0815.htmlThird Party Advisory
• http://secunia.com/advisories/58591Third Party Advisory
• http://secunia.com/advisories/58614Third Party Advisory
• http://secunia.com/advisories/59021Third Party Advisory
• http://secunia.com/advisories/59057Third Party Advisory
• http://secunia.com/advisories/59408Third Party Advisory
• http://secunia.com/advisories/60320Third Party Advisory
• http://secunia.com/advisories/60415Third Party Advisory
• http://secunia.com/advisories/61888Third Party Advisory
• http://support.f5.com/kb/en-us/solutions/public/15000/400/sol15423.htmlThird Party Advisory
• http://www.debian.org/security/2014/dsa-3056Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:116Third Party Advisory
• http://www.novell.com/support/kb/doc.php?id=7015302Third Party Advisory
• http://www.novell.com/support/kb/doc.php?id=7015303Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1102323Issue Tracking, Third Party Advisory
• http://advisories.mageia.org/MGASA-2014-0247.htmlThird Party Advisory
• http://git.savannah.gnu.org/cgit/libtasn1.git/commit/?id=1c3ccb3e040bf13e342ee60bc23b21b97b11923fPatch, Vendor Advisory
• http://linux.oracle.com/errata/ELSA-2014-0594.htmlThird Party Advisory
• http://linux.oracle.com/errata/ELSA-2014-0596.htmlThird Party Advisory
• http://lists.gnu.org/archive/html/help-libtasn1/2014-05/msg00006.htmlMailing List, Patch, Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00002.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00015.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0594.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0596.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0687.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0815.htmlThird Party Advisory
• http://secunia.com/advisories/58591Third Party Advisory
• http://secunia.com/advisories/58614Third Party Advisory
• http://secunia.com/advisories/59021Third Party Advisory
• http://secunia.com/advisories/59057Third Party Advisory
• http://secunia.com/advisories/59408Third Party Advisory
• http://secunia.com/advisories/60320Third Party Advisory
• http://secunia.com/advisories/60415Third Party Advisory
• http://secunia.com/advisories/61888Third Party Advisory
• http://support.f5.com/kb/en-us/solutions/public/15000/400/sol15423.htmlThird Party Advisory
• http://www.debian.org/security/2014/dsa-3056Third Party Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:116Third Party Advisory
• http://www.novell.com/support/kb/doc.php?id=7015302Third Party Advisory
• http://www.novell.com/support/kb/doc.php?id=7015303Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1102323Issue Tracking, Third Party Advisory

Published

Jun 5, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3462The ".encfs6.xml" configuration file in encfs before 1.7.5 a…7.5
• CVE-2014-3463Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-3464The EJB invocation handler implementation in Red Hat JBossWS…
• CVE-2014-3465The gnutls_x509_dn_oid_name function in lib/x509/common.c in…
• CVE-2014-3466Buffer overflow in the read_server_hello function in lib/gnu…
• CVE-2014-3467Multiple unspecified vulnerabilities in the DER decoder in G…
• CVE-2014-3469The (1) asn1_read_value_type and (2) asn1_read_value functio…
• CVE-2014-3470The ssl3_send_client_key_exchange function in s3_clnt.c in O…
• CVE-2014-3471Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Q…
• CVE-2014-3472The isCallerInRole function in SimpleSecurityManager in JBos…
• CVE-2014-3473Cross-site scripting (XSS) vulnerability in the Orchestratio…
• CVE-2014-3474Cross-site scripting (XSS) vulnerability in horizon/static/h…