Fedora 9 : gnutls-2.0.4-3.fc9 (2008-4259)

Fixes critical security issue GNUTLS-SA-2008-1 described here: http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html All applications and system services which utilize gnutls library must be restarted for the updates to take effect. Note that Tenable Network Security has extracted...

GnuTLS堆溢出及拒绝服务漏洞

BUGTRAQ ID: 29292 CVECAN ID: CVE-2008-1948,CVE-2008-1949,CVE-2008-1950 GnuTLS是用于实现TLS加密协议的函数库。 GnuTLS在处理各种畸形TLS报文时存在多个安全漏洞，可能导致拒绝服务或完全入侵运行该库应用程序所在的操作系统。 如果用户所发送的Client Hello消息包含有Server Name扩展的话，就可能在lib/extservername.c文件的gnutlsservernamerecvparams函数中触发堆溢出，导致执行任意代码。...

Fedora 7 : gnutls-1.6.3-3.fc7 (2008-4274)

Fixes critical security issue GNUTLS-SA-2008-1 described here: http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html All applications and system services which utilize gnutls library must be restarted for the updates to take effect. Note that Tenable Network Security has extracted...

GLSA-200805-20 : GnuTLS: Execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200805-20 GnuTLS: Execution of arbitrary code Ossi Herrala and Jukka Taimisto of Codenomicon reported three vulnerabilities in libgnutls of GnuTLS: 'Client Hello' messages containing an invalid server name can lead to a buffer...

RHEL 5 : gnutls (RHSA-2008:0489)

Updated gnutls packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The GnuTLS Library provides support for cryptographic algorithms and protocols such as TL...

Debian DSA-1581-1 : gnutls13 - several vulnerabilities

Several remote vulnerabilities have been discovered in GNUTLS, an implementation of the SSL/TLS protocol suite. NOTE: The libgnutls13 package, which provides the GNUTLS library, does not contain logic to automatically restart potentially affected services. You must restart affected services...

RHEL 4 : gnutls (RHSA-2008:0492)

Updated gnutls packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The GnuTLS Library provides support for cryptographic algorithms and protocols such as...

Fedora 8 : gnutls-1.6.3-3.fc8 (2008-4183)

Fixes critical security issue GNUTLS-SA-2008-1 described here: http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html All applications and system services which utilize gnutls library must be restarted for the updates to take effect. Note that Tenable Network Security has extracted...

gnutls security update

CentOS Errata and Security Advisory CESA-2008:0489 Updated gnutls packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The GnuTLS Library provides support fo...

Buffer overflow

The gnutlsservernamerecvparams function in lib/extservername.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service crash or...

Integer overflow

Integer signedness error in the gnutlsciphertext2compressed function in lib/gnutlscipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service buffer over-read and crash via a certain integer value in the Random field in an encrypted Client Hello message withi...

CVE-2008-1949

The gnutlsrecvclientkxmessage function in lib/gnutlskx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service NULL dereference and crash v...

CVE-2008-1948

The gnutlsservernamerecvparams function in lib/extservername.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service crash or...

Design/Logic Flaw

The gnutlsrecvclientkxmessage function in lib/gnutlskx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service NULL dereference and crash v...

CVE-2008-1948

The gnutlsservernamerecvparams function in lib/extservername.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service crash or...

CVE-2008-1949

The gnutlsrecvclientkxmessage function in lib/gnutlskx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service NULL dereference and crash v...

USN-613-1: GnuTLS vulnerabilities

Multiple flaws were discovered in the connection handling of GnuTLS. A remote attacker could exploit this to crash applications linked against GnuTLS, or possibly execute arbitrary code with permissions of the application's user...

[SECURITY] Fedora 7 Update: gnutls-1.6.3-3.fc7

GnuTLS is a project that aims to develop a library which provides a secure layer, over a reliable transport layer. Currently the GnuTLS library implem ents the proposed standards by the IETF's TLS working group...

[SECURITY] Fedora 9 Update: gnutls-2.0.4-3.fc9

GnuTLS is a project that aims to develop a library which provides a secure layer, over a reliable transport layer. Currently the GnuTLS library implem ents the proposed standards by the IETF's TLS working group...

[SECURITY] Fedora 8 Update: gnutls-1.6.3-3.fc8

GnuTLS is a project that aims to develop a library which provides a secure layer, over a reliable transport layer. Currently the GnuTLS library implem ents the proposed standards by the IETF's TLS working group...