CVE-2014-3467

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-06-05 · updated 2026-06-17

Description

Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.

Affected products

Debian Linux: 7.0
F5 Arx Firmware: from 6.0.0 through 6.4.0
[UNKNOWN] gnutls: before 3.5.7 — fixed in 3.5.7
GnuTLS libtasn1: before 3.6 — fixed in 3.6
RedHat Enterprise Linux Desktop: 5.0, 6.0, 7.0
RedHat Enterprise Linux Eus: 6.5, 7.3, 7.4, 7.5, 7.6, 7.7
RedHat Enterprise Linux Server: 5.0, 6.0, 7.0
RedHat Enterprise Linux Server Aus: 6.5, 7.3, 7.4, 7.6, 7.7
RedHat Enterprise Linux Server Tus: 6.5, 7.3, 7.6, 7.7
RedHat Enterprise Linux Workstation: 5.0, 6.0, 7.0
RedHat Virtualization: 6.0
SUSE Linux Enterprise Server 15 SP1: 11-sp3
SUSE Linux Enterprise High Availability Extension: 11-sp3
SUSE Linux Enterprise Server: 11-sp1, 11-sp2, 11-sp3
SUSE Linux Enterprise Software Development Kit: 11-sp3

How to fix

Upgrade to a fixed version: [UNKNOWN] gnutls 3.5.7; GnuTLS libtasn1 3.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2014-3467 or the next vulnerability affects your stack