CVE-Katalog
CVE-2016-6129
libtomcrypt: CVE-2016-6129
- Schweregrad
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.78% · Oct 22, 2026
The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libtomcrypt | sid | 1.18.2+dfsg-8 | fixed |
| Debian | libtomcrypt | forky | 1.18.2+dfsg-8 | fixed |
| Debian | libtomcrypt | trixie | 1.18.2+dfsg-7 | fixed |
| Debian | libtomcrypt | bookworm | 1.18.2-6 | fixed |
| Ubuntu | libtomcrypt | 14.04 | 1.17-3.2ubuntu1 | vulnerable |
| Ubuntu | libtomcrypt | 14.04 | 1.17-5 | vulnerable |
| Ubuntu | libtomcrypt | 14.04 | 1.17-5ubuntu0.1 | fixed |
| Ubuntu | libtomcrypt | 16.04 | 1.17-7 | vulnerable |
| Ubuntu | libtomcrypt | 16.04 | 1.17-7ubuntu0.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libtomcrypt | source | sid | 1.17-8 | not yet assigned | Not reported | [837042] |
| Debian | libtomcrypt | source | forky | 1.17-8 | not yet assigned | Not reported | [837042] |
| Debian | libtomcrypt | source | trixie | 1.17-8 | not yet assigned | Not reported | [837042] |
| Debian | libtomcrypt | source | bookworm | 1.17-8 | not yet assigned | Not reported | [837042] |
| Ubuntu | libtomcrypt | deb | 14.04 | 1.17-5ubuntu0.1 | Not reported | UBUNTU-CVE-2016-6129 | Not reported |
| Ubuntu | libtomcrypt | deb | 16.04 | 1.17-7ubuntu0.1 | Not reported | UBUNTU-CVE-2016-6129 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libtomcrypt1]Behoben
Quellpaket: [libtomcrypt]
Details (2)
1.18.2-6· amd64 · bookwormBehoben · Behoben:
1.17-8dsa · libtomcrypt · debian · bookworm; dsa · libtomcrypt · debian · 12
1.18.2-6· arm64 · bookwormBehoben · Behoben:
1.17-8dsa · libtomcrypt · debian · bookworm; dsa · libtomcrypt · debian · 12
- [libtomcrypt-dev]Behoben
Quellpaket: [libtomcrypt]
Details (2)
1.18.2-6· amd64 · bookwormBehoben · Behoben:
1.17-8dsa · libtomcrypt · debian · bookworm; dsa · libtomcrypt · debian · 12
1.18.2-6· arm64 · bookwormBehoben · Behoben:
1.17-8dsa · libtomcrypt · debian · bookworm; dsa · libtomcrypt · debian · 12
[Debian 13 (Trixie)]
- [libtomcrypt1]Behoben
Quellpaket: [libtomcrypt]
Details (2)
1.18.2+dfsg-7+b2· amd64 · trixieBehoben · Behoben:
1.17-8dsa · libtomcrypt · debian · 13
1.18.2+dfsg-7+b2· arm64 · trixieBehoben · Behoben:
1.17-8dsa · libtomcrypt · debian · 13
- [libtomcrypt-dev]Behoben
Quellpaket: [libtomcrypt]
Details (2)
1.18.2+dfsg-7+b2· amd64 · trixieBehoben · Behoben:
1.17-8dsa · libtomcrypt · debian · 13
1.18.2+dfsg-7+b2· arm64 · trixieBehoben · Behoben:
1.17-8dsa · libtomcrypt · debian · 13
Beobachtet: