{"id":"CVE-2016-4008","details":"The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.","modified":"2026-07-08T05:48:39.878000587Z","published":"2016-05-05T18:59:10.380Z","related":["SUSE-SU-2016:1600-1","SUSE-SU-2016:1601-1","SUSE-SU-2017:2699-1","SUSE-SU-2017:2700-1","openSUSE-SU-2024:10414-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"12.04"},{"last_affected":"12.04"},{"introduced":"14.04"},{"last_affected":"14.04"},{"introduced":"15.10"},{"last_affected":"15.10"},{"introduced":"16.04"},{"last_affected":"16.04"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux","cpes":["cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*"]},{"cpes":["cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"22"},{"last_affected":"22"},{"introduced":"23"},{"last_affected":"23"},{"introduced":"24"},{"last_affected":"24"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora"},{"cpes":["cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.2"},{"last_affected":"13.2"}],"source":"CPE_STRING","vendor_product":"opensuse:opensuse"}]},"references":[{"type":"WEB","url":"http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625"},{"type":"WEB","url":"http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=f435825c0f527a8e52e6ffbc3ad0bc60531d537e"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182299.html"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182907.html"},{"type":"WEB","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183221.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-updates/2016-06/msg00047.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-updates/2016-06/msg00097.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2016/04/11/3"},{"type":"WEB","url":"https://lists.gnu.org/archive/html/help-libtasn1/2016-04/msg00009.html"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3568"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-2957-1"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-2957-2"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201703-05"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/gnutls/libtasn1","events":[{"introduced":"0"},{"last_affected":"1e3d04bce839540c6a3f8f14c8521d8390042f23"}],"database_specific":{"cpe":"cpe:2.3:a:gnu:libtasn1:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"4.7"}],"source":"CPE_RANGE"}}],"versions":["libtasn1_4.7","libtasn1_4_6","libtasn1_4_5","libtasn1_4_4","libtasn1_4_3","libtasn1_4_2","libtasn1_4_1","libtasn1_4_0","libtasn1_3_6","libtasn1_3_5","libtasn1_3_4","libtasn1_3_3","libtasn1_3_2","libtasn1_3_1","libtasn1_3_0","libtasn1_2_13","libtasn1_2_12","libtasn1_2_11","libtasn1_2_10","libtasn1_2_9","libtasn1_2_8","libtasn1_2_7","libtasn1_2_6","libtasn1_2_5","libtasn1_2_4","libtasn1_2_3","libtasn1_2_2","libtasn1_2_1","libtasn1_2_0","libtasn1_1_6","libtasn1_1_5","libtasn1_1_4","libtasn1_1_3","libtasn1_1_2","libtasn1_1_1","libtasn1_1_0","libtasn1_0_3_10","libtasn1_0_3_9","libtasn1_0_3_8","libtasn1_0_3_7","libtasn1_0_3_6","libtasn1_0_3_5","libtasn1_0_3_4","libtasn1_0_3_3","libtasn1_0_3_2","libtasn1-0-3-2","libtasn1_0_3_1","libtasn1_0_3_0","libtasn1_0_2_18","libtasn1_0_2_17","libtasn1_0_2_16","libtasn1_0_2_15","libtasn1_0_2_14","libtasn1_0_2_13","libtasn1_0_2_12","libtasn1_0_2_11","libtasn1_0_2_10","libtasn1_0_2_9","libtasn1_0_2_8","libtasn1_0_2_7","libtasn1_0_2_6","libtasn1_0_2_5","libtasn1_0_2_4","libtasn1_0_2_3","libtasn1_0_2_2","libtasn1_0_2_1","libtasn1_0_2_0","libtasn1_0_1_2","gnutls_0_5_1","gnutls_0_5_0","libtasn1_after_rename","libasn1_0_1_0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4008.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}