ASN1SCC: Stack buffer overflow and out-of-bounds read in XER tokenizer NT()

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

ASN1SCC is an open source ASN.1 compiler for embedded systems. Prior to 4.7.0.1, the XER tokenizer NT() in asn1crt/asn1crt_encoding_xer.c, which is reached by all XER decode paths, copies tag characters into a fixed char Value[100] field without a length bound and reads input and lookahead bytes without checking the buffer count. A crafted XER message with an overlong tag can overwrite the tokenizer's stack frame, while a truncated tag or unterminated processing-instruction or comment sequence can read beyond the input and may cause a CPU spin. The flaws can disclose adjacent memory, corrupt stack data, crash or hang the decoder, and potentially permit code execution. This issue is fixed in version 4.7.0.1.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…sn1scc/security/advisories/GHSA-38q3-fg5h-wwf9 Diğer
• github.com/…ommit/fe6ab763bc60d8a2def4104c15414809b45fffd9 Diğer
• github.com/esa/asn1scc/releases/tag/4.7.0.1 Diğer

Kayıt geçmişi

1. 5 Kas 2026 19:49Yayımlandı

İlgili açıklar

• 5,3 CVE-2026-75615ASN1SCC: Out-of-bounds read via unvalidated character index in ASN.1 string decoders
• 8,1 CVE-2026-75614ASN1SCC: Out-of-bounds write in BitStream_DecodeConstraintWholeNumber (uPER/ACN)
• 8,2 CVE-2026-92698FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read
• 7,5 CVE-2026-92697FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read
• 8,2 CVE-2026-92693FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser
• 8,2 CVE-2026-92695FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated frames