Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnutls | Aug 30, 2017 | Jun 3, 2014 |
| Centos_linux | — | Upgrade gnutls-guileUpgrade gnutlsUpgrade gnutls-utilsUpgrade gnutls-devel | Dec 1, 2016 | Jun 3, 2014 |
| Debian | — | Upgrade gnutls28Upgrade gnutls26 | Jul 30, 2024 | Jun 3, 2014 |
| Freebsd | — | Upgrade gnutlsUpgrade gnutls3 | Dec 10, 2025 | Jun 4, 2014 |
| Gentoo Linux | — | Upgrade net-libs/gnutls. | Oct 30, 2017 | Jun 3, 2014 |
| Oracle Solaris | — | Upgrade library/gnutls to version 2.8.6-0.175.1.21.0.4.0 on Solaris 11.1Upgrade library/libtasn1 to version 2.8-0.175.1.21.0.4.0 on Solaris 11.1 | May 29, 2017 | Jun 3, 2014 |
| Oracle_linux | — | Upgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls-c++Upgrade gnutlsUpgrade gnutls-utils | Oct 16, 2024 | Jun 3, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 30, 2014 |
| Suse | — | Upgrade libgnutls-openssl-develUpgrade libgnutls26-x86Upgrade libgnutlsxx28Upgrade libgnutls-develUpgrade libgnutls26-32bitUpgrade libgnutls-extra26Upgrade libgnutlsxx-develUpgrade libgnutls30Upgrade libgnutls-openssl27Upgrade gnutlsUpgrade libgnutls28Upgrade libgnutls-dane0Upgrade libgnutls30-32bitUpgrade libgnutls28-32bitUpgrade libgnutls26Upgrade libgnutls-extra-devel | Dec 18, 2015 | Jun 3, 2014 |
| Ubuntu | — | Upgrade libgnutls26 | Nov 8, 2024 | Jun 3, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub