CVE-2019-17362

In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.

• CWE-125

• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00041.html
• https://github.com/libtom/libtomcrypt/issues/507Exploit, Third Party Advisory
• https://github.com/libtom/libtomcrypt/pull/508Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/10/msg00010.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/
• https://vuldb.com/?id.142995Permissions Required
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00041.html
• https://github.com/libtom/libtomcrypt/issues/507Exploit, Third Party Advisory
• https://github.com/libtom/libtomcrypt/pull/508Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/10/msg00010.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/
• https://vuldb.com/?id.142995Permissions Required

Published

Oct 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17357Cacti through 1.2.7 is affected by a graphs.php?template_id=…6.5
• CVE-2019-17358Cacti through 1.2.7 is affected by multiple instances of lib…8.1
• CVE-2019-17359The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 …7.5
• CVE-2019-1736A vulnerability in the firmware of the Cisco UCS C-Series Ra…6.6
• CVE-2019-17360A vulnerability in Hitachi Command Suite 7.x and 8.x before …7.5
• CVE-2019-17361In SaltStack Salt through 2019.2.0, the salt-api NET API wit…9.8
• CVE-2019-17364The processCommandUploadLog() function of libcommon.so in Pe…9.8
• CVE-2019-17365Nix through 2.3 allows local users to gain access to an arbi…7.8
• CVE-2019-17366Citrix Application Delivery Management (ADM) 12.1 before bui…8.8
• CVE-2019-17367OpenWRT firmware version 18.06.4 is vulnerable to CSRF via w…8.8
• CVE-2019-17368S-CMS v1.5 has XSS in tpl.php via the member/member_login.ph…6.1
• CVE-2019-17369OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Pane…6.5