In LibTomCrypt through 1.18.2, the der_decode_utf8_string...
Moderate severity
Unreviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Dec 14, 2023
Description
Published by the National Vulnerability Database
Oct 9, 2019
Published to the GitHub Advisory Database
May 24, 2022
Last updated
Dec 14, 2023
In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.
References