Input validation error in Botan and Debian Linux - CVE-2015-5726

Vulnerability identifier: #VU40303

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-5726

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The BER decoder in Botan 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (application crash) via an empty BIT STRING in ASN.1 data.

Botan
Debian Linux
Fedora
monotone
botan
qca
code-editor
qt-creator

Install update from vendor's website.

monotone - addressed in versions 1.1-13.fc22, 1.1-13.fc23
botan - addressed in versions 1.8.15-1.el5, 1.8.15-1.el6, 1.10.12-1.el7, 1.10.12-1.fc22, 1.10.12-1.fc23
qca - addressed in versions 2.1.1-4.fc22, 2.1.1-4.fc23
code-editor - addressed in versions 2.8.1-13.fc22, 2.8.1-13.fc23
qt-creator - addressed in versions 3.5.1-2.el7, 3.6.0-6.fc22, 3.6.0-6.fc23

• http://botan.randombit.net/security.html
• http://www.debian.org/security/2016/dsa-3565

• Multiple vulnerabilities in Randombit Botan
• Fedora 23 update for botan, code-editor, monotone, qca, qt-creator
• Fedora 22 update for botan, code-editor, monotone, qca, qt-creator
• Fedora EPEL 7 update for botan, qt-creator
• Fedora EPEL 5 update for botan
• Fedora EPEL 6 update for botan