Vulnerability Details : CVE-2016-4579
Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to the "returned length of the object from _ksba_ber_parse_tl."
Vulnerability category: Denial of service
Products affected by CVE-2016-4579
- cpe:2.3:a:gnupg:libksba:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-4579
1.33%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 79 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-4579
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2016-4579
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-4579
-
http://www.ubuntu.com/usn/USN-2982-1
USN-2982-1: Libksba vulnerabilities | Ubuntu security notices
-
http://www.openwall.com/lists/oss-security/2016/05/10/8
oss-security - CVE request: libksba out-of-bouds read remote DOS issue fixed in 1.3.4
-
https://security.gentoo.org/glsa/201706-22
libksba: Denial of Service and information disclosure (GLSA 201706-22) — Gentoo security
-
http://lists.opensuse.org/opensuse-updates/2016-06/msg00028.html
openSUSE-SU-2016:1525-1: moderate: Security update for libksba
-
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=a7eed17a0b2a1c09ef986f3b4b323cd31cea2b64
git.gnupg.org Git
-
http://www.openwall.com/lists/oss-security/2016/05/11/10
oss-security - Re: CVE request: libksba out-of-bouds read remote DOS issue fixed in 1.3.4
-
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=a7eed17a0b2a1c09ef986f3b4b323cd31cea2b64
git.gnupg.org Git - libksba.git/commit
Jump to