CVE-2014-3469

libtasn1: asn1_read_value_type() NULL pointer dereference

The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument.

CVSS 2.0 · 5.0 Medium EPSS 3.8% KEV · Not listed

Vendors

Debian Gnu Redhat and 1 more

Products

Debian Linux Gnutls Libtasn1 and 12 more

CVE-2014-3468

libtasn1: asn1_get_bit_der() can return negative bit length

The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.

CVSS 2.0 · 7.5 High EPSS 3.8% KEV · Not listed

Vendors

Debian F5 Gnu and 2 more

Products

Debian Linux Arx Arx Firmware and 14 more

CVE-2014-3467

libtasn1: multiple boundary check issues

Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.

CVSS 2.0 · 5.0 Medium EPSS 6.8% KEV · Not listed

Vendors

Debian F5 Gnu and 2 more

Products

Debian Linux Arx Arx Firmware and 14 more

CVE-2014-3466

gnutls: insufficient session id length check in _gnutls_read_server_hello (GNUTLS-SA-2014-3)

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.

CVSS 2.0 · 6.8 Medium EPSS 11.2% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2014-3465

gnutls: gnutls_x509_dn_oid_name NULL pointer dereference

The gnutls_x509_dn_oid_name function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN.

CVSS 2.0 · 5.0 Medium EPSS 4.1% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2014-1959

gnutls: incorrect handling of V1 intermediate certificates (GNUTLS-SA-2014-1)

lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates.

CVSS 2.0 · 5.8 Medium EPSS 3.4% KEV · Not listed

Vendors

Gnu

Products

Gnutls

CVE-2014-0092

gnutls: incorrect error handling in certificate verification (GNUTLS-SA-2014-2)

lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

CVSS 2.0 · 5.8 Medium EPSS 29.9% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux Rhel Els and 2 more

CVE-2009-5138

gnutls: incorrect handling of V1 intermediate certificates

GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.

CVSS 2.0 · 5.8 Medium EPSS 1.8% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2013-4466

gnutls: dane_query_tlsa() buffer overflow (GNUTLS-SA-2013-3)

Buffer overflow in the dane_query_tlsa function in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed

Vendors

Gnu

Products

Gnutls

CVE-2012-1573

gnutls: TLS record handling issue (GNUTLS-SA-2012-2, MU-201202-01)

gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.

CVSS 2.0 · 5.0 Medium EPSS 4.0% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2012-1569

libtasn1: DER decoding buffer overflow (GNUTLS-SA-2012-3, MU-201202-02)

The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Libtasn1 Enterprise Linux

CVE-2012-0390

gnutls: DTLS plaintext recovery attack

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.

CVSS 2.0 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Gnu

Products

Gnutls

CVE-2011-4128

gnutls: buffer overflow in gnutls_session_get_data() (GNUTLS-SA-2011-2)

Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service (application crash) via a large SessionTicket.

CVSS 2.0 · 4.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2010-0731

gnutls: gnutls_x509_crt_get_serial incorrect serial decoding from ASN1 (BE64) [GNUTLS-SA-2010-1]

The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.

CVSS 2.0 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2013-1619

gnutls: TLS CBC padding timing attack (lucky-13)

The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

CVSS 2.0 · 4.0 Medium EPSS 6.4% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2013-2116

gnutls: out of bounds read in _gnutls_ciphertext2compressed (GNUTLS-SA-2013-2)

The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169.

CVSS 2.0 · 5.0 Medium EPSS 3.8% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2013-4487

gnutls: dane_query_tlsa() CVE-2013-4466 fix off-by-one

Off-by-one error in the dane_raw_tlsa in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries. NOTE: this issue is due to an incomplete fix for CVE-2013-4466.

CVSS 2.0 · 5.0 Medium EPSS 1.9% KEV · Not listed

Vendors

Gnu Opensuse

Products

Gnutls Opensuse

CVE-2012-1663

gnutls: double-free vulnerability in libgnutls 3.0.x

Double free vulnerability in libgnutls in GnuTLS before 3.0.14 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted certificate list.

CVSS 2.0 · 7.5 High EPSS 4.9% KEV · Not listed

Vendors

Gnu

Products

Gnutls

CVE-2006-7239

gnutls: unknown hash algorithm NULL pointer derefence [GNUTLS-SA-2006-2]

The _gnutls_x509_oid2mac_algorithm function in lib/gnutls_algorithms.c in GnuTLS before 1.4.2 allows remote attackers to cause a denial of service (crash) via a crafted X.509 certificate that uses a hash algorithm that is not supported by GnuTLS, which triggers a NULL pointer dereference.

CVSS 2.0 · 5.0 Medium EPSS 1.5% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Enterprise Linux

CVE-2019-3836

gnutls: invalid pointer access upon receiving async handshake messages

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.

CVSS 3.0 · 5.9 Medium EPSS 3.4% KEV · Not listed

Vendors

Fedoraproject Gnu Opensuse and 1 more

Products

Fedora Gnutls Leap and 1 more