In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow
could occur, which would cause an incorrect length field to be computed.
Some API callers may use the returned (incorrect and attacker controlled)
length field in a way which later causes memory corruption or other
failure.

It was discovered that Botan did not properly decode BER data while parsing
untrusted inputs such as X.509 certificates. An attacker could possibly
use this issue to cause memory corruption or other failure, resulting in an
integer overflow attack.