Upstream information

CVE-2016-5080 at MITRE

Description

Integer overflow in the rtxMemHeapAlloc function in asn1rt_a.lib in Objective Systems ASN1C for C/C++ before 7.0.2 allows context-dependent attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow), on a system running an application compiled by ASN1C, via crafted ASN.1 data.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having critical severity.

CVSS v2 Scores
  National Vulnerability Database SUSE
Base Score 10 9.3
Vector AV:N/AC:L/Au:N/C:C/I:C/A:C AV:N/AC:M/Au:N/C:C/I:C/A:C
Access Vector Network Network
Access Complexity Low Medium
Authentication None None
Confidentiality Impact Complete Complete
Integrity Impact Complete Complete
Availability Impact Complete Complete
CVSS v3 Scores
  National Vulnerability Database
Base Score 9.8
Vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Access Vector Network
Access Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High

Note from the SUSE Security Team

We do not track this CVE as affecting our products. We do not ship the asn1c compiler and we do not have indication that any of our packages contains code generated by that compiler.

No SUSE Bugzilla entries cross referenced.

No SUSE Security Announcements cross referenced.