Timlegge

**Name of the Vulnerable Software and Affected Versions** Crypt::OpenSSL::PKCS12 versions prior to 1.96 **Description** A heap out-of-bounds read is possible in the UTF8STRING path of the `print attribute()` function. The function copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length using strncpy, which fails to include a NUL terminator. Consequently, downstream callers executing strlen() on the result pass an inflated length to `newSVpvn()`, allowing adjacent heap bytes influenced by an attacker to be copied into a Perl scalar. **Recommendations** Update to version 1.96 or later.