CVE-2017-5336

Stack-based buffer overflow in the cdkpkgetkeyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate...

gnutls security update

CentOS Errata and Security Advisory CESA-2017:0574 An update for gnutls is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2017-5335

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service out-of-memory error and crash via a crafted OpenPGP certificate...

CVE-2017-5336

Stack-based buffer overflow in the cdkpkgetkeyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate...

CVE-2017-5335

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service out-of-memory error and crash via a crafted OpenPGP certificate...

CVE-2017-5337

Multiple heap-based buffer overflows in the readattribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate...

CVE-2017-5336

Stack-based buffer overflow in the cdkpkgetkeyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate...

CVE-2017-5335

GnuTLS CVE-2017-5335 affects the OpenPGP certificate handling in lib/opencdk/read-packet.c: streams reading certificates can trigger an out-of-memory crash via crafted OpenPGP data. Affected versions are GnuTLS before 3.3.26 and 3.5.x before 3.5.8. Multiple external advisories (CentOS, Red Hat, U...

CVE-2017-5337

Multiple heap-based buffer overflows in the readattribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate...

CVE-2017-5337

CVE-2017-5337 is a GnuTLS vulnerability involving multiple heap-based buffer overflows in read_attribute triggered by crafted OpenPGP certificates. Affected versions are GnuTLS builds before 3.3.26 and 3.5.x before 3.5.8. The connected materials confirm the root cause as heap overflows in read_at...

CVE-2017-5336

CVE-2017-5336 : GnuTLS contains a stack-based buffer overflow in the cdk_pk_get_keyid function (lib/opencdk/pubkey.c), exploitable via crafted OpenPGP certificates. Affected versions are GnuTLS before 3.3.26 and 3.5.x before 3.5.8. Remediation: upgrade to a fixed release (upstream 3.3.26 or later...

RedHat Update for gnutls RHSA-2017:0574-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

gnutls: Out of memory while parsing crafted OpenPGP certificate

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service out-of-memory error and crash via a crafted OpenPGP certificate...

gnutls: Heap read overflow in read-packet.c

Multiple heap-based buffer overflows in the readattribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate...

Ubuntu 14.04 LTS : GnuTLS vulnerability (USN-3183-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3183-2 advisory. USN-3183-1 fixed CVE-2016-8610 in GnuTLS in Ubuntu 16.04 LTS and Ubuntu 16.10. This update provides the corresponding update for Ubuntu 12.04 LTS and Ubuntu 14.04...

USN-3183-2: GnuTLS vulnerability

USN-3183-1 fixed CVE-2016-8610 in GnuTLS in Ubuntu 16.04 LTS and Ubuntu 16.10. This update provides the corresponding update for Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Original advisory details: Stefan Buehler discovered that GnuTLS incorrectly verified the serial length of OCSP responses. A remo...

Google Releases E2EMail to Open Source

The ongoing struggle to provide encrypted email solutions that aren’t on a PGP level of complexity and difficulty is a real challenge. Google’s attempt at it, called E2EMail, was introduced more than a year ago as an effort to give users a Chrome app that allows for the simple exchange of private...

Updated gnutls packages fix security vulnerability

Remote denial of service in SSL alert handling. CVE-2016-8610 In gnutlsx509extimportproxy: if the language was set but the policy wasn't, that could lead to a double free. CVE-2017-5334 Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows. CVE-2017-5335,...

openSUSE Security Update : gnutls (openSUSE-2017-207)

This update for gnutls fixes the following security issues : - GnuTLS could have crashed when processing maliciously crafted OpenPGP certificates GNUTLS-SA-2017-2, bsc1018832, CVE-2017-5335, CVE-2017-5337, CVE-2017-5336 - GnuTLS could have falsely accepted certificates when using OCSP...

Security update for gnutls (important)

This update for gnutls fixes the following security issues: - GnuTLS could have crashed when processing maliciously crafted OpenPGP certificates GNUTLS-SA-2017-2, bsc1018832, CVE-2017-5335, CVE-2017-5337, CVE-2017-5336 - GnuTLS could have falsely accepted certificates when using OCSP...