gnutls26 -- out-of-bounds array read

2013-05-29T00:00:00
ID DSA-2697
Type debian
Reporter Debian
Modified 2013-05-29T00:00:00

Description

It was discovered that a malicious client could crash a GNUTLS server and vice versa, by sending TLS records encrypted with a block cipher which contain invalid padding.

The oldstable distribution (squeeze) is not affected because the security fix that introduced this vulnerability was not applied to it.

For the stable distribution (wheezy), this problem has been fixed in version 2.12.20-7.

For the unstable distribution (sid), this problem has been fixed in version 2.12.23-5.

We recommend that you upgrade your gnutls26 packages.