rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-3394 
The Smart Call Home (SCH) implementation in Cisco ASA Software 8.2 before 8.2(5.50), 8.4 before 8.4(7.15), 8.6 before 8.6(1.14), 8.7 before 8.7(1.13), 9.0 before 9.0(4.8), and 9.1 before 9.1(5.1) allows remote attackers to bypass certificate validation via an arbitrary VeriSign certificate, aka Bug ID CSCun10916.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T10:00:00.000Z
CVE-2014-3395 
Cisco WebEx Meetings Server (WMS) 2.5 allows remote attackers to trigger the download of arbitrary files via a crafted URL, aka Bug ID CSCup10343.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-30T22:00:00.000Z
CVE-2014-3396 
Cisco IOS XR on ASR 9000 devices does not properly use compression for port-range and address-range encoding, which allows remote attackers to bypass intended Typhoon line-card ACL restrictions via transit traffic, aka Bug ID CSCup30133.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-05T01:00:00.000Z
CVE-2014-3397 
The network stack in Cisco TelePresence MCU Software before 4.3(2.30) allows remote attackers to cause a denial of service (memory consumption) via crafted TCP packets, aka Bug ID CSCtz35468.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z
CVE-2014-3398 
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to obtain potentially sensitive software-version information by reading the verbose response data that is provided for a request to an unspecified URL, aka Bug ID CSCuq65542.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-05T01:00:00.000Z
CVE-2014-3399 
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.2(.2.4) and earlier does not properly manage session information during creation of a SharePoint handler, which allows remote authenticated users to overwrite arbitrary RAMFS cache files or inject Lua programs, and consequently cause a denial of service (portal outage or system reload), via crafted HTTP requests, aka Bug ID CSCup54208.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-07T10:00:00.000Z
CVE-2014-3400 
Cisco WebEx Meetings Server allows remote authenticated users to obtain sensitive information by reading logs, aka Bug IDs CSCuq36417 and CSCuq40344.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-05T01:00:00.000Z
CVE-2014-3402 
The authentication-manager process in the web framework in Cisco Intrusion Prevention System (IPS) 7.0(8)E4 and earlier in Cisco Intrusion Detection System (IDS) does not properly manage user tokens, which allows remote attackers to cause a denial of service (temporary MainApp hang) via a crafted connection request to the management interface, aka Bug ID CSCuq39550.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T10:00:00.000Z
CVE-2014-3403 
The Autonomic Networking Infrastructure (ANI) component in Cisco IOS XE does not properly validate certificates, which allows remote attackers to spoof devices via crafted messages, aka Bug ID CSCuq22647.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T01:00:00.000Z
CVE-2014-3404 
The Autonomic Networking Infrastructure (ANI) component in Cisco IOS XE does not properly validate certificates, which allows remote attackers to trigger acceptance of an invalid message via crafted messages, aka Bug ID CSCuq22677.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T01:00:00.000Z
CVE-2014-3405 
Cisco IOS XE enables the IPv6 Routing Protocol for Low-Power and Lossy Networks (aka RPL) on both the Autonomic Control Plane (ACP) and external Autonomic Networking Infrastructure (ANI) interfaces, which allows remote attackers to conduct route-injection attacks via crafted RPL advertisements on an ANI interface, aka Bug ID CSCuq22673.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-10T01:00:00.000Z
CVE-2014-3406 
Race condition in the IP logging feature in Cisco Intrusion Prevention System (IPS) Software 7.1(7)E4 and earlier allows remote attackers to cause a denial of service (device reload) via crafted IP traffic that matches a problematic rule, aka Bug ID CSCud82085.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z
CVE-2014-3407 
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-28T02:00:00.000Z
CVE-2014-3408 
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Prime Optical 10 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq80763.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-19T01:00:00.000Z
CVE-2014-3409 
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-25T10:00:00.000Z
CVE-2014-3410 
The syslog-management subsystem in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to obtain an administrator password by waiting for an administrator to copy a file, and then (1) sniffing the network for a syslog message or (2) reading a syslog message in a file on a syslog server, aka Bug IDs CSCuq22357 and CSCur41860.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-20T00:00:00.000Z
CVE-2014-3411 
Unspecified vulnerability in the NSM XDB service in Juniper NSM before 2012.2R8 allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-19T14:00:00.000Z
CVE-2014-3412 
Unspecified vulnerability in Juniper Junos Space before 13.3R1.8, when the firewall in disabled, allows remote attackers to execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-20T14:00:00.000Z
CVE-2014-3413 
The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote attackers to obtain sensitive information and consequently obtain administrative control by leveraging database access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-05T17:00:00.000Z
CVE-2014-3414 
Cross-site request forgery (CSRF) vulnerability in Sharetronix before 3.4 allows remote attackers to hijack the authentication of administrators for requests that add administrative privileges to a user via the admin parameter to admin/administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-29T14:00:00.000Z
CVE-2014-3415 
SQL injection vulnerability in Sharetronix before 3.4 allows remote authenticated users to execute arbitrary SQL commands via the invite_users[] parameter to the /invite page for a group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-29T14:00:00.000Z
CVE-2014-3416 
uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-29T14:00:00.000Z
CVE-2014-3417 
uPortal before 4.0.13.1 does not properly check the CONFIG permission, which allows remote authenticated users to configure portlets by leveraging the SUBSCRIBE permission for a portlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-29T14:00:00.000Z
CVE-2014-3418 
config/userAdmin/login.tdf in Infoblox NetMRI before 6.8.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the skipjackUsername parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-15T14:00:00.000Z
CVE-2014-3419 
Infoblox NetMRI before 6.8.5 has a default password of admin for the "root" MySQL database account, which makes it easier for local users to obtain access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-15T14:00:00.000Z
CVE-2014-3421 
lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.face.ppm temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-3422 
lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file under /tmp/esrc/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-3423 
lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic.##### temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-3424 
lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp.##### temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-3425 
NCSA Mosaic 2.0 and earlier allows local users to cause a denial of service ("remote control" outage) by creating a /tmp/xmosaic.pid file for every possible PID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-3426 
NCSA Mosaic 2.1 through 2.7b5 allows local users to cause a denial of service ("remote control" outage) by creating a /tmp/Mosaic.pid file for every possible PID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T10:00:00.000Z
CVE-2014-3427 
CRLF injection vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the model parameter to servlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-16T14:00:00.000Z
CVE-2014-3428 
Cross-site scripting (XSS) vulnerability in Yealink VoIP Phones with firmware 28.72.0.2 allows remote attackers to inject arbitrary web script or HTML via the model parameter to servlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-16T18:00:00.000Z
CVE-2014-3429 
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-3430 
Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service (resource consumption) via an incomplete SSL/TLS handshake for an IMAP/POP3 connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T19:00:00.000Z
CVE-2014-3431 
Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-21T15:00:00.000Z
CVE-2014-3432 
Cross-site scripting (XSS) vulnerability in the management console in Symantec Data Insight 3.x and 4.x before 4.5 allows remote attackers to inject arbitrary web script or HTML via an unspecified form field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-27T14:00:00.000Z
CVE-2014-3433 
Cross-site scripting (XSS) vulnerability in the management console in Symantec Data Insight 3.x and 4.x before 4.5 allows remote attackers to inject arbitrary web script or HTML via an unspecified form field, related to an "HTML script injection" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-27T14:00:00.000Z
CVE-2014-3434 
Buffer overflow in the sysplant driver in Symantec Endpoint Protection (SEP) Client 11.x and 12.x before 12.1 RU4 MP1b, and Small Business Edition before SEP 12.1, allows local users to execute arbitrary code via a long argument to a 0x00222084 IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T19:00:00.000Z
CVE-2014-3436 
Symantec Encryption Desktop 10.3.x before 10.3.2 MP3, and Symantec PGP Desktop 10.0.x through 10.2.x, allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted encrypted e-mail message that decompresses to a larger size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-22T01:00:00.000Z
CVE-2014-3437 
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-07T11:00:00.000Z
CVE-2014-3438 
Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-07T11:00:00.000Z
CVE-2014-3439 
ConsoleServlet in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to write to arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-07T11:00:00.000Z
CVE-2014-3440 
The Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x before 6.0 MP1 allows remote authenticated users to execute arbitrary commands by leveraging client-system access to upload a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T11:00:00.000Z
CVE-2014-3441 
codec\libpng_plugin.dll in VideoLAN VLC Media Player 2.1.3 allows remote attackers to cause a denial of service (crash) via a crafted .png file, as demonstrated by a png in a .wave file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T19:00:00.000Z
CVE-2014-3442 
Winamp 5.666 and earlier allows remote attackers to cause a denial of service (memory corruption and crash) via a malformed .FLV file, related to f263.w5s.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-23T14:00:00.000Z
CVE-2014-3443 
JetMPAd.ax in JetAudio 8.1.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .ogg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T19:00:00.000Z
CVE-2014-3444 
The GetGUID function in codecs/dmp4.dll in RealNetworks RealPlayer 16.0.3.51 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (write access violation and application crash) via a malformed .3gp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-20T10:00:00.000Z
CVE-2014-3445 
backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authentication by leveraging knowledge of the administrator password hash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T14:09:12.000Z
CVE-2014-3446 
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-30T14:00:00.000Z
CVE-2014-3447 
BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T13:21:09.000Z
CVE-2014-3448 
BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T13:25:26.000Z
CVE-2014-3449 
BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T13:28:31.000Z
CVE-2014-3450 
Unspecified vulnerability in Panda Gold Protection and Global Protection 2014 7.01.01 and earlier, Internet Security 2014 19.01.01 and earlier, and AV Pro 2014 13.01.01 and earlier allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-23T14:00:00.000Z
CVE-2014-3451 
OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-18T18:00:00.000Z
CVE-2014-3452 
Filters\LAV\avfilter-lav-4.dll in K-lite Codec 10.4.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .jpg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-16T15:00:00.000Z
CVE-2014-3453 
Eval injection vulnerability in the flag_import_form_validate function in includes/flag.export.inc in the Flag module 7.x-3.0, 7.x-3.5, and earlier for Drupal allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area to admin/structure/flags/import.  NOTE: this issue could also be exploited by other attackers if the administrator ignores a security warning on the permissions assignment page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-17T19:00:00.000Z
CVE-2014-3454 
Cross-site request forgery (CSRF) vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to hijack the authentication of users for requests that create categories via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2014-3455 
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) CreateProperty, (2) CreateTemplate, (3) CreateForm, and (4) CreateClass special pages in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allow remote attackers to hijack the authentication of users for requests that have unspecified impact and vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-12T14:00:00.000Z
CVE-2014-3456 
Cross-site scripting (XSS) vulnerability in GitLab Enterprise Edition (EE) 6.6.0 before 6.6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-13T15:00:00.000Z
CVE-2014-3459 
Heap-based buffer overflow in SolarWinds Network Configuration Manager (NCM) before 7.3 allows remote attackers to execute arbitrary code via the PEstrarg1 property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-07T10:00:00.000Z
CVE-2014-3460 
Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in Agent Manager in NetIQ Sentinel allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-20T10:00:00.000Z
CVE-2014-3461 
hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a heap-based buffer overflow, related to "USB post load checks."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-04T21:00:00.000Z
CVE-2014-3462 
The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2014-3464 
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers by leveraging permissions to the EJB class. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2133.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-19T18:00:00.000Z
CVE-2014-3465 
The gnutls_x509_dn_oid_name function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-10T14:00:00.000Z
CVE-2014-3466 
Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-03T14:00:00.000Z
CVE-2014-3467 
Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T20:00:00.000Z
CVE-2014-3468 
The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-05T20:00:00.000Z