Name: CVE-2017-5336: Improper Restriction of Operations within the Bounds of a Memory Buffer
Creator: Rapid7
Published: 2017-03-24T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2017-5336, CWE-119, CVSS 9.8, EPSS 0.03948

Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.

CVSS Details

CVSS 3.0 Base Score: 9.8
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Amazon_linux	—	Upgrade gnutls	Apr 17, 2017	Jan 28, 2017
Centos_linux	—	Upgrade gnutls-develUpgrade gnutls-daneUpgrade gnutls-guileUpgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-utilsUpgrade gnutls-debuginfo	Aug 28, 2019	Mar 24, 2017
Debian	—	Upgrade gnutls28	Jul 30, 2024	Mar 24, 2017
Gentoo Linux	—	Upgrade net-libs/gnutls.	Oct 30, 2017	Mar 24, 2017
Huawei Euleros 2_0_sp1	—	Upgrade gnutls-c++Upgrade gnutlsUpgrade gnutls-develUpgrade gnutls-utilsUpgrade gnutls-dane	Nov 30, 2017	Mar 24, 2017
Huawei Euleros 2_0_sp2	—	Upgrade gnutls-develUpgrade gnutls-utilsUpgrade gnutls-c++Upgrade gnutlsUpgrade gnutls-dane	Nov 30, 2017	Mar 24, 2017
Oracle Solaris	—	Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4	Oct 19, 2018	Mar 24, 2017
Oracle_linux	—	Upgrade gnutlsUpgrade gnutls-c++Upgrade gnutls-develUpgrade gnutls-utilsUpgrade gnutls-daneUpgrade gnutls-guile	Mar 28, 2017	Jan 10, 2017
Redhat_linux	—	No solution existsUpgrade gnutls-guileUpgrade gnutls-daneUpgrade gnutls-utilsUpgrade gnutlsUpgrade gnutls-debuginfoUpgrade gnutls-develUpgrade gnutls-c++	Mar 21, 2017	Jan 28, 2017
Suse	—	Upgrade libgnutls-extra26Upgrade libgnutls-openssl27Upgrade libgnutls-develUpgrade libgnutlsxx28Upgrade libgnutls26Upgrade libgnutls26-32bitUpgrade libgnutlsxx-develUpgrade libgnutls28Upgrade libgnutls-openssl-develUpgrade libgnutls-extra-develUpgrade gnutlsUpgrade libgnutls28-32bitUpgrade libgnutls26-x86	Jan 28, 2017	Jan 27, 2017
Ubuntu	—	Upgrade libgnutls30Upgrade libgnutls26	Feb 2, 2017	Jan 28, 2017

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence