A NULL pointer dereference flaw was found in libtasn1's asn1_read_value_type() / asn1_read_value() function. If an application called the function with a NULL value for an ivalue argument to determine the amount of memory needed to store data to be read from the ASN.1 input, libtasn1 could incorrectly attempt to dereference the NULL pointer, causing an application using the library to crash. The libtasn1 library is used by the GnuTLS library to parse X.509 certificates. The gnutls packages in Red Hat Enterprise Linux 5 and earlier use bundled libtasn1, packages in Red Hat Enterprise Linux 6 and later depend on the library provided by a separate libtasn1 package. Upstream commits: http://git.savannah.gnu.org/cgit/libtasn1.git/commit/lib/element.c?id=a8b3e14f84174e01755bfd1be5448fffce7c9ffa http://git.savannah.gnu.org/cgit/libtasn1.git/commit/lib/element.c?id=3d6a02f19ff15a38dae9686033e37499b3968256 http://git.savannah.gnu.org/cgit/libtasn1.git/commit/lib/element.c?id=53958290ab731c8486531a3bdef54a933533579d
Acknowledgment: Red Hat would like to thank GnuTLS upstream for reporting this issue.
Fixed upstream in libtasn1 3.6: http://lists.gnu.org/archive/html/help-libtasn1/2014-05/msg00006.html
Created libtasn1 tracking bugs for this issue: Affects: fedora-all [bug 1103087]
Created mingw-libtasn1 tracking bugs for this issue: Affects: fedora-all [bug 1103088]
Created mingw32-gnutls tracking bugs for this issue: Affects: epel-5 [bug 1103089]
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2014:0596 https://rhn.redhat.com/errata/RHSA-2014-0596.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2014:0594 https://rhn.redhat.com/errata/RHSA-2014-0594.html
libtasn1-3.6-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
libtasn1-3.6-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products: Red Hat Enterprise Linux 7 Via RHSA-2014:0687 https://rhn.redhat.com/errata/RHSA-2014-0687.html
This issue has been addressed in following products: RHEV-H and Agents for RHEL-6 Via RHSA-2014:0815 https://rhn.redhat.com/errata/RHSA-2014-0815.html