Libtom

libtom

4 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-36328 2Fedoraproject Libtom 2Fedora Libtommath Jun 17, 2026 Sep 1, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).
CVE-2019-17362 2Debian Libtom 2Debian Linux Libtomcrypt Jun 17, 2026 Oct 9, 2019 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of serv...Show more In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.Show less
CVE-2018-12437 3Libtom LinaroTrustedfirmware 3Libtomcrypt Op TeeOp Tee Jun 5, 2026 Jun 15, 2018 N/A· v4 4.9 MEDIUM· v3 1.9 LOW· v2 LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local mach...Show more LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.Show less
CVE-2016-6129 3Libtom Op TeeTrustedfirmware 3Libtomcrypt Op TeeOp Tee Os Jun 5, 2026 Feb 13, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote a...Show more The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.Show less