Buffer overflow in CRL number parsing in wolfSSL

Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storing the CRL number as a hexadecimal string, and a stack-based overflow for sufficiently sized CRL numbers. With appropriately crafted CRLs, either of these out of bound writes could be triggered. Note this only affects builds that specifically enable CRL support, and the user would need to load a CRL from an untrusted source.

N/A

跨界内存写

wolfSSL（CyaSSL） 安全漏洞

wolfSSL（CyaSSL）是美国wolfSSL公司的一个针对嵌入式系统开发人员使用的小的、可移植的嵌入式SSL编程库。 wolfSSL（CyaSSL）存在安全漏洞，该漏洞源于CRL解析器在解析CRL编号时存在两个缓冲区溢出漏洞，可能导致堆缓冲区溢出或栈缓冲区溢出，攻击者可通过特制的CRL触发越界写入。

N/A

N/A