Description
An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/p11-glue/p11-kit/releases ↗
- https://github.com/p11-glue/p11-kit/security/advisories/GHSA-q4r3-hm6m-mvc2 ↗
- https://www.debian.org/security/2021/dsa-4822 ↗
- https://lists.debian.org/debian-lts-announce/2021/01/msg00002.html ↗
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E ↗
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E ↗
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html ↗