What is CVE-2015-2806?

CVE-2015-2806 is a high-severity software vulnerability (Memory corruption) with a CVSS score of 10. Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.

Is CVE-2015-2806 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 8%.

What products does CVE-2015-2806 affect?

Tracked products affected include Ubuntu. Check the version you run to see whether it is affected.

How do I fix CVE-2015-2806?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

← All products

CVE-2015-2806

HIGH severity · CVSS 10 · Memory corruption

10CVSS HIGH

Summary

Stack-based buffer overflow in asn1_der_decoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges required—

User interaction—

Confidentiality impact—

Integrity impact—

Availability impact—

Exploit probability (EPSS)8%

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products we track (1)

Ubuntu

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=4d4f992826a4962790ecd0cce6fbba4a415ce149
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154741.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154805.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155117.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155270.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155435.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155483.htmlAdvisory
http://www.debian.org/security/2015/dsa-3220Advisory