gnutls: Use-of-uninitialized-value in __gmpn_tdiv_qr

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5818028144984064 Project: gnutls Fuzzer: libFuzzergnutlssrpclientfuzzer Fuzz target binary: gnutlssrpclientfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-valu...

Oracle Linux 7 : gnutls (ELSA-2017-2292)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2292 advisory. - Address crash in OCSP status request extension, by eliminating the unneeded parsing CVE-2017-7507, 1455828 Tenable has extracted the preceding...

CVE-2016-4456

The "GNUTLSKEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem...

Code injection

The "GNUTLSKEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem...

DEBIAN-CVE-2016-4456

The "GNUTLSKEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem...

CVE-2016-4456

The "GNUTLSKEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem...

CVE-2016-4456

The "GNUTLSKEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem...

CVE-2016-4456

The CVE-2016-4456 issue affects GnuTLS, specifically version 3.4.12. The vulnerability stems from how GNUTLS_KEYLOGFILE is handled via getenv(), which can allow an attacker to overwrite and corrupt arbitrary files in the filesystem. Several connected sources confirm the impact and the affected co...

gnutls: Use-of-uninitialized-value in wrap_nettle_cipher_aead_decrypt

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5729187954425856 Project: gnutls Fuzzer: libFuzzergnutlspskclientfuzzer Fuzz target binary: gnutlspskclientfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-valu...

gnutls security, bug fix, and enhancement update

3.3.26-9 - Address crash in OCSP status request extension, by eliminating the unneeded parsing CVE-2017-7507, 1455828 3.3.26-7 - Address interoperability issue with 3.5.x 1388932 - Reject CAs which are both trusted and blacklisted in trust module 1375303 - Added new functions to set issuer and...

gnutls: Use-of-uninitialized-value in _nettle_ecc_mod_random

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=6247063903797248 Project: gnutls Fuzzer: libFuzzergnutlspskclientfuzzer Fuzz target binary: gnutlspskclientfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-valu...

gnutls: Use-of-uninitialized-value in _nettle_aes_set_key

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5962058463969280 Project: gnutls Fuzzer: libFuzzergnutlspskclientfuzzer Fuzz target binary: gnutlspskclientfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-valu...

gnutls: Use-of-uninitialized-value in mpz_import

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=5790636118638592 Project: gnutls Fuzzer: libFuzzergnutlssrpclientfuzzer Fuzz target binary: gnutlssrpclientfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-valu...

RedHat Update for gnutls RHSA-2017:2292-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : gnutls (RHSA-2017:2292)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2292 advisory. The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as...

gnutls: Incorrect certificate validation when using OCSP responses (GNUTLS-SA-2016-3)

A flaw was found in the way GnuTLS validated certificates using OCSP responses. This could falsely report a certificate as valid under certain circumstances...

gnutls: Double-free while decoding crafted X.509 certificates

A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could create a specially-crafted certificate which, when processed by an application compiled against GnuTLS, could cause that application to crash...

gnutls: Out of memory while parsing crafted OpenPGP certificate

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service out-of-memory error and crash via a crafted OpenPGP certificate...

gnutls: Out-of-bounds write related to the cdk_pkt_read function (GNUTLS-SA-2017-3)

GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdkpktread function in opencdk/read-packet.c. This issue which is a subset of the vendor's GNUTLS-SA-2017-3 report is fixed in 3.5.10...

gnutls: Crash upon receiving well-formed status_request extension

A null pointer dereference flaw was found in the way GnuTLS processed ClientHello messages with statusrequest extension. A remote attacker could use this flaw to cause an application compiled with GnuTLS to crash...