SUSE-SU-2017:0348-1 Security update for gnutls

This update for gnutls fixes the following security issues: - GnuTLS could have crashed when processing maliciously crafted OpenPGP certificates GNUTLS-SA-2017-2, bsc1018832, CVE-2017-5335, CVE-2017-5337, CVE-2017-5336 - GnuTLS could have falsely accepted certificates when using OCSP...

SUSE SLES11 Security Update : gnutls (SUSE-SU-2017:0304-1)

This update for gnutls fixes the following issues : - Malformed asn1 definitions could cause a segmentation fault in the asn1 definition parser bsc961491. - CVE-2016-8610: Remote denial of service in SSL alert handling bsc1005879. - CVE-2017-5335: Decoding a specially crafted OpenPGP certificate...

SUSE-SU-2017:0304-1 Security update for gnutls

This update for gnutls fixes the following issues: - Malformed asn1 definitions could cause a segmentation fault in the asn1 definition parser bsc961491. - CVE-2016-8610: Remote denial of service in SSL alert handling bsc1005879. - CVE-2017-5335: Decoding a specially crafted OpenPGP certificate...

gnutls: Attempting free in _gnutls_buffer_append_printf

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5494487300177920 Project: gnutls Fuzzer: libFuzzergnutlsx509parserfuzzer Fuzz target binary: gnutlsx509parserfuzzer Job Type: libfuzzerasangnutls Platform Id: linux Crash Type:...

gnutls: Heap-buffer-overflow in cdk_pkt_read

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6104165726027776 Project: gnutls Fuzzer: libFuzzergnutlsopenpgpcertparserfuzzer Fuzz target binary: gnutlsopenpgpcertparserfuzzer Job Type: libfuzzerasangnutls Platform Id: linux...

Fedora 24 : gnutls (2017-e86817c42e)

Security fix for CVE-2017-5337, CVE-2017-5334, CVE-2017-5336, CVE-2017-5335 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora Update for gnutls FEDORA-2017-e86817c42e

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 24 Update: gnutls-3.4.17-2.fc24

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

GnuTLS 'lib/opencdk/read-packet.c' buffer overflow vulnerability

GnuTLS is a free secure communications library for implementing SSL, TLS and DTLS protocols. A heap buffer overflow vulnerability exists in GnuTLS that could be exploited by a remote attacker to submit a specially crafted request to crash an application linking to this library...

GnuTLS Stack Buffer Overflow Vulnerability

GnuTLS is a free secure communications library for implementing SSL, TLS and DTLS protocols. GnuTLS suffers from a stack buffer overflow vulnerability that could be exploited by a remote attacker to submit a specially crafted request to crash an application linking to this library...

GnuTLS Security Bypass Vulnerability (CNVD-2017-00484)

GnuTLS is a free secure communications library for implementing SSL, TLS and DTLS protocols. A security bypass vulnerability exists in GnuTLS that allows remote attackers to perform unauthorized operations by submitting special requests to bypass security restrictions...

[slackware-security] gnutls

New gnutls packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/gnutls-3.5.8-i586-1slack14.2.txz: Upgraded. This update fixes some bugs and security issues. For more information, see:...

Slackware 14.0 / 14.1 / 14.2 / current : gnutls (SSA:2017-011-02)

New gnutls packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2017-011-02. The text itself is...

CVE-2017-5337

Multiple heap-based buffer overflows in the readattribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate...

CVE-2017-5336

Stack-based buffer overflow in the cdkpkgetkeyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate...

CVE-2017-5335

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service out-of-memory error and crash via a crafted OpenPGP certificate...

CVE-2017-5334

A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could create a specially-crafted certificate which, when processed by an application compiled against GnuTLS, could cause that application to crash...

PT-2017-16439

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 3.3.26 GnuTLS versions 3.5.x prior to 3.5.8 Description A double free vulnerability exists in the gnutls x509 ext import proxy function, allowing remote attackers to have an unspecified impact via crafted policy langua...

UBUNTU-CVE-2017-5335

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service out-of-memory error and crash via a crafted OpenPGP certificate...

CVE-2017-5336

Stack-based buffer overflow in the cdkpkgetkeyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate...