CVE-2013-1619

CVE-2013-1619 affects the TLS implementation in GnuTLS prior to 2.12.23, 3.0.x prior to 3.0.28, and 3.1.x prior to 3.1.7. The vulnerability arises from improper consideration of timing side-channel attacks on a noncompliant CBC padding check during processing of malformed CBC padding, enabling re...

CVE-2012-0390

Technical details about CVE-2012-0390 (DTLS timing side-channel in GnuTLS

CVE-2014-8155

GnuTLS before 2.9.10 does not verify CA certificate activation/expiration dates, enabling MITM via certificates not yet valid or no longer valid. Affected: GnuTLS library (pre-2.9.10). Mitigation: upgrade to 2.9.10 or later where the issue is fixed (per advisory references). If exploiting details...

CVE-2011-4128

CVE-2011-4128 affects GnuTLS: a buffer overflow in gnutls_session_get_data in lib/gnutls_session.c can be triggered when a client uses nonstandard session resumption. A remote TLS server can cause an application crash (DoS) by sending a large SessionTicket. Affected are GnuTLS 2.12.x prior to 2.1...

CVE-2009-1415

CVE-2009-1415 affects GnuTLS up to version 2.6.5 (fixed in 2.6.6). The flaw resides in lib/pk-libgcrypt.c within libgnutls, which mishandles invalid DSA signatures. A malformed DSA key can trigger a denial of service (application crash) and may cause additional impact, including a free of an unin...