10.0
CRITICAL
CVE-2015-2806
libtasn1 ASN1 DER Decoding Stack-based Buffer Overflow
Description

Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.

INFO

Published Date :

April 10, 2015, 3 p.m.

Last Modified :

Nov. 21, 2024, 2:28 a.m.

Remotely Exploitable :

Yes !

Impact Score :

10.0

Exploitability Score :

10.0
Public PoC/Exploit Available at Github

CVE-2015-2806 has a 2 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2015-2806 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Canonical ubuntu_linux
1 Fedoraproject fedora
1 Debian debian_linux
1 Gnu libtasn1
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2015-2806.

URL Resource
http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=4d4f992826a4962790ecd0cce6fbba4a415ce149
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154741.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154805.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155117.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155270.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155435.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155483.html Third Party Advisory
http://www.debian.org/security/2015/dsa-3220 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:193 Broken Link
http://www.openwall.com/lists/oss-security/2015/03/29/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/31/2 Mailing List Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securityfocus.com/bid/73436
http://www.securitytracker.com/id/1032080 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2559-1 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1860
https://security.gentoo.org/glsa/201509-04
http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=4d4f992826a4962790ecd0cce6fbba4a415ce149
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154741.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154805.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155117.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155270.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155435.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155483.html Third Party Advisory
http://www.debian.org/security/2015/dsa-3220 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:193 Broken Link
http://www.openwall.com/lists/oss-security/2015/03/29/4 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/31/2 Mailing List Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securityfocus.com/bid/73436
http://www.securitytracker.com/id/1032080 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2559-1 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1860
https://security.gentoo.org/glsa/201509-04

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

None

Makefile Go Dockerfile

Updated: 1 year, 3 months ago
1 stars 0 fork 0 watcher
Born at : Aug. 21, 2018, 2:07 a.m. This repo has been linked 5 different CVEs too.

Vulnerability scanner for Linux/FreeBSD, agentless, written in golang.

Makefile Go

Updated: 2 months, 3 weeks ago
2 stars 2 fork 2 watcher
Born at : Aug. 27, 2017, 8:17 p.m. This repo has been linked 5 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2015-2806 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2015-2806 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=4d4f992826a4962790ecd0cce6fbba4a415ce149
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154741.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154805.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155117.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155270.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155435.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155483.html
    Added Reference http://www.debian.org/security/2015/dsa-3220
    Added Reference http://www.mandriva.com/security/advisories?name=MDVSA-2015:193
    Added Reference http://www.openwall.com/lists/oss-security/2015/03/29/4
    Added Reference http://www.openwall.com/lists/oss-security/2015/03/31/2
    Added Reference http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
    Added Reference http://www.securityfocus.com/bid/73436
    Added Reference http://www.securitytracker.com/id/1032080
    Added Reference http://www.ubuntu.com/usn/USN-2559-1
    Added Reference https://access.redhat.com/errata/RHSA-2017:1860
    Added Reference https://security.gentoo.org/glsa/201509-04
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Added Reference MITRE http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=4d4f992826a4962790ecd0cce6fbba4a415ce149 [No types assigned]
    Removed Reference MITRE http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=4d4f992826a4962790ecd0cce6fbba4a415ce149
  • CVE Modified by [email protected]

    Jan. 05, 2018

    Action Type Old Value New Value
    Added Reference https://access.redhat.com/errata/RHSA-2017:1860 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 22, 2016

    Action Type Old Value New Value
    Added Reference https://security.gentoo.org/glsa/201509-04 [No Types Assigned]
  • CVE Modified by [email protected]

    Nov. 30, 2016

    Action Type Old Value New Value
    Added Reference http://www.securityfocus.com/bid/73436 [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 04, 2016

    Action Type Old Value New Value
    Added Reference http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
  • Modified Analysis by [email protected]

    Aug. 25, 2016

    Action Type Old Value New Value
    Changed CPE Configuration Configuration 1 OR *cpe:2.3:a:gnu:libtasn1:4.3:*:*:*:*:*:*:* (and previous) Configuration 2 OR *cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* Configuration 1 OR *cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* Configuration 2 OR *cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Configuration 3 OR *cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* Configuration 4 OR *cpe:2.3:a:gnu:libtasn1:4.3:*:*:*:*:*:*:* (and previous)
    Changed Reference Type http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154741.html No Types Assigned http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154741.html Third Party Advisory
    Changed Reference Type http://www.securitytracker.com/id/1032080 No Types Assigned http://www.securitytracker.com/id/1032080 Third Party Advisory, VDB Entry
    Changed Reference Type http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155270.html No Types Assigned http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155270.html Third Party Advisory
    Changed Reference Type http://www.mandriva.com/security/advisories?name=MDVSA-2015:193 No Types Assigned http://www.mandriva.com/security/advisories?name=MDVSA-2015:193 Broken Link
    Changed Reference Type http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154805.html No Types Assigned http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154805.html Third Party Advisory
    Changed Reference Type http://www.ubuntu.com/usn/USN-2559-1 No Types Assigned http://www.ubuntu.com/usn/USN-2559-1 Third Party Advisory
    Changed Reference Type http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=4d4f992826a4962790ecd0cce6fbba4a415ce149 No Types Assigned http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=4d4f992826a4962790ecd0cce6fbba4a415ce149 Issue Tracking, Patch
    Changed Reference Type http://www.openwall.com/lists/oss-security/2015/03/29/4 No Types Assigned http://www.openwall.com/lists/oss-security/2015/03/29/4 Third Party Advisory, Mailing List
    Changed Reference Type http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155117.html No Types Assigned http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155117.html Third Party Advisory
    Changed Reference Type http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155483.html No Types Assigned http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155483.html Third Party Advisory
    Changed Reference Type http://www.openwall.com/lists/oss-security/2015/03/31/2 No Types Assigned http://www.openwall.com/lists/oss-security/2015/03/31/2 Third Party Advisory, Mailing List
    Changed Reference Type http://www.debian.org/security/2015/dsa-3220 No Types Assigned http://www.debian.org/security/2015/dsa-3220 Third Party Advisory
    Changed Reference Type http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155435.html No Types Assigned http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155435.html Third Party Advisory
  • CVE Modified by [email protected]

    May. 06, 2015

    Action Type Old Value New Value
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155117.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154741.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155483.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154805.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155270.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155435.html
  • CVE Modified by [email protected]

    Apr. 30, 2015

    Action Type Old Value New Value
    Added Reference http://www.securitytracker.com/id/1032080
  • CVE Modified by [email protected]

    Apr. 18, 2015

    Action Type Old Value New Value
    Added Reference http://www.debian.org/security/2015/dsa-3220
  • Modified Analysis by [email protected]

    Apr. 13, 2015

    Action Type Old Value New Value
    Added CPE Configuration Configuration 1 OR *cpe:2.3:a:gnu:libtasn1:4.3:*:*:*:*:*:*:* (and previous) Configuration 2 OR *cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* *cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*
    Added CVSS V2 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
    Added CWE CWE-119
  • Initial Analysis by [email protected]

    Apr. 13, 2015

    Action Type Old Value New Value
  • Initial Analysis by [email protected]

    Apr. 13, 2015

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.76 }} -0.18%

score

0.80894

percentile

CVSS2 - Vulnerability Scoring System
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability