SUSE SLED12 / SLES12 Security Update : gnutls (SUSE-SU-2018:2842-1)

This update for gnutls fixes the following issues : Security issues fixed : Improved mitigations against Lucky 13 class of attacks - 'Just in Time' PRIME + PROBE cache-based side channel attack can lead to plaintext recovery CVE-2018-10846, bsc1105460 - HMAC-SHA-384 vulnerable to Lucky thirteen...

SUSE SLES12 Security Update : gnutls (SUSE-SU-2018:2825-1)

This update for gnutls fixes the following issues : This update for gnutls fixes the following issues : Security issues fixed : Improved mitigations against Lucky 13 class of attacks 'Just in Time' PRIME + PROBE cache-based side channel attack can lead to plaintext recovery CVE-2018-10846,...

SUSE-SU-2018:2842-1 Security update for gnutls

This update for gnutls fixes the following issues: Security issues fixed: - Improved mitigations against Lucky 13 class of attacks - 'Just in Time' PRIME + PROBE cache-based side channel attack can lead to plaintext recovery CVE-2018-10846, bsc1105460 - HMAC-SHA-384 vulnerable to Lucky thirteen...

SUSE-SU-2018:2825-1 Security update for gnutls

This update for gnutls fixes the following issues: This update for gnutls fixes the following issues: Security issues fixed: - Improved mitigations against Lucky 13 class of attacks - 'Just in Time' PRIME + PROBE cache-based side channel attack can lead to plaintext recovery CVE-2018-10846,...

CVE-2016-1000030

Pidgin version 2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutlsx509crtinit and gnutlsx509crtimport that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client...

DEBIAN-CVE-2016-1000030

Pidgin version 2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutlsx509crtinit and gnutlsx509crtimport that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client...

CVE-2016-1000030

Pidgin version 2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutlsx509crtinit and gnutlsx509crtimport that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client...

CVE-2016-1000030

Pidgin version 2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutlsx509crtinit and gnutlsx509crtimport that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client...

gnutls/gnutls_pkcs12_key_parser_fuzzer: Use-of-uninitialized-value in _pkcs12_decode_safe_contents

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5762063012462592 Project: gnutls Fuzzer: libFuzzergnutlspkcs12keyparserfuzzer Fuzz target binary: gnutlspkcs12keyparserfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type:...

gnutls/gnutls_pkcs8_key_parser_fuzzer: Use-of-uninitialized-value in read_pbkdf2_params

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5642279797129216 Project: gnutls Fuzzer: libFuzzergnutlspkcs8keyparserfuzzer Fuzz target binary: gnutlspkcs8keyparserfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type:...

gnutls/gnutls_pkcs12_key_parser_fuzzer: Use-of-uninitialized-value in _decode_pkcs12_auth_safe

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5756813052477440 Project: gnutls Fuzzer: libFuzzergnutlspkcs12keyparserfuzzer Fuzz target binary: gnutlspkcs12keyparserfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type:...

gnutls/gnutls_dn_parser_fuzzer: Use-of-uninitialized-value in decode_complex_string

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5751385119784960 Project: gnutls Fuzzer: libFuzzergnutlsdnparserfuzzer Fuzz target binary: gnutlsdnparserfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-value...

gnutls/gnutls_pkcs12_key_parser_fuzzer: Use-of-uninitialized-value in gnutls_pkcs12_get_bag

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5694185181544448 Project: gnutls Fuzzer: libFuzzergnutlspkcs12keyparserfuzzer Fuzz target binary: gnutlspkcs12keyparserfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type:...

gnutls/gnutls_ocsp_resp_parser_fuzzer: Use-of-uninitialized-value in _gnutls_x509_read_pkalgo_params

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5693444165468160 Project: gnutls Fuzzer: libFuzzergnutlsocsprespparserfuzzer Fuzz target binary: gnutlsocsprespparserfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type:...

gnutls/gnutls_srp_server_fuzzer: Use-of-uninitialized-value in _gnutls_x509_get_time

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5657484820217856 Project: gnutls Fuzzer: libFuzzergnutlssrpserverfuzzer Fuzz target binary: gnutlssrpserverfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-valu...

GnuTLS Plaintext Recovery Vulnerability

GnuTLS is a free secure communications library for implementing SSL, TLS and DTLS protocols. A security vulnerability exists in the GnuTLS implementation. An attacker can exploit the vulnerability to recover plaintext content with the help of specially crafted packets...

Code injection

It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets...

Code injection

It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets...

Cross site scripting

A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets...

CVE-2018-10845

It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets...