Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnutls | Aug 30, 2017 | Jun 3, 2014 |
| Centos_linux | — | Upgrade gnutls-guileUpgrade gnutls-utilsUpgrade gnutls-develUpgrade gnutls | Dec 1, 2016 | Jun 3, 2014 |
| Debian | — | Upgrade gnutls28Upgrade gnutls26 | Jul 30, 2024 | Jun 3, 2014 |
| Freebsd | — | Upgrade gnutlsUpgrade gnutls3 | Dec 10, 2025 | Jun 4, 2014 |
| Gentoo Linux | — | Upgrade net-libs/gnutls. | Oct 30, 2017 | Jun 3, 2014 |
| Oracle Solaris | — | Upgrade library/libtasn1 to version 2.8-0.175.1.21.0.4.0 on Solaris 11.1Upgrade library/gnutls to version 2.8.6-0.175.1.21.0.4.0 on Solaris 11.1 | May 29, 2017 | Jun 3, 2014 |
| Oracle_linux | — | Upgrade gnutls-c++Upgrade gnutls-daneUpgrade gnutls-develUpgrade gnutls-utilsUpgrade gnutls | Oct 16, 2024 | Jun 3, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 30, 2014 |
| Suse | — | Upgrade libgnutls-dane0Upgrade libgnutls28Upgrade libgnutls-extra-develUpgrade libgnutls28-32bitUpgrade libgnutls30-32bitUpgrade libgnutls26Upgrade gnutlsUpgrade libgnutls-openssl-develUpgrade libgnutls30Upgrade libgnutlsxx28Upgrade libgnutls-openssl27Upgrade libgnutls-develUpgrade libgnutls-extra26Upgrade libgnutlsxx-develUpgrade libgnutls26-x86Upgrade libgnutls26-32bit | Dec 18, 2015 | Jun 3, 2014 |
| Ubuntu | — | Upgrade libgnutls26 | Nov 8, 2024 | Jun 3, 2014 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub