CVE-2019-17362 is a critical vulnerability in LibTomCrypt versions up to 1.18.2, affecting Debian Linux and LibTomCrypt itself. It stems from improper UTF-8 sequence detection in the der_decode_utf8_string function, allowing attackers to trigger an out-of-bounds read, leading to a denial of service or information disclosure. With a CVSS score of 9.1 (CRITICAL), this vulnerability is remotely exploitable with low attack complexity and no user interaction required, posing a high risk to confidentiality and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting it is not widely known or exploited in the wild.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.18.2CPE matchmatch criteria | cpe:2.3:a:libtom:libtomcrypt:*:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2019-17362
Jun 11, 2024In LibTomCrypt through 1.18.2 the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.
Oct 8, 2019libtomcrypt: out-of-bounds read in the der_decode_utf8_string function in der_decode_utf8_string.c
Aug 10, 2019