The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnutls | Aug 30, 2017 | Jul 3, 2013 |
| Centos_linux | — | Upgrade gnutls-develUpgrade gnutlsUpgrade gnutls-utils | Dec 1, 2016 | Jul 3, 2013 |
| Gentoo Linux | — | Upgrade net-libs/gnutls. | Oct 30, 2017 | Jul 3, 2013 |
| Oracle Solaris | — | Upgrade system/display-manager/gdm to version 2.30.7-0.175.1.11.0.1.0 on Solaris 11.1Upgrade library/gnutls to version 2.8.6-0.175.1.11.0.1.0 on Solaris 11.1 | May 29, 2017 | Jul 3, 2013 |
| Oracle_linux | — | Upgrade gnutlsUpgrade gnutls-guileUpgrade gnutls-develUpgrade gnutls-utils | Oct 16, 2024 | Jul 3, 2013 |
| Suse | — | Upgrade libgnutls-extra-develUpgrade sle-sdk-releaseUpgrade gnutls-devel-32bitUpgrade libgnutls26Upgrade gnutls-devel-64bitUpgrade libgnutls-extra26Upgrade libgnutls26-x86Upgrade gnutlsUpgrade gnutls-32bitUpgrade gnutls-develUpgrade libgnutls-develUpgrade gnutls-x86Upgrade gnutls-64bitUpgrade libgnutls26-32bitUpgrade sle-hae-release | Feb 17, 2015 | Jul 3, 2013 |
| Ubuntu | — | Upgrade libgnutls26 | Nov 8, 2024 | Jul 3, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub