Description
The asn1f_lookup_symbol_impl function in asn1fix_retrieve.c in libasn1fix.a in asn1c 0.9.28 allows remote attackers to cause a denial of service (segmentation fault) via a crafted .asn1 file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asn1c | No fix yet | — |
| Debian 13 | asn1c | No fix yet | — |
| Debian 12 | asn1c | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | asn1c | 0.9.29-1.1 | openSUSE-SU-2026:11106-1 |
Advisories 1
- openSUSE-SU-2026:11106-1 asn1c-0.9.29-1.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026