CVSS: 9.8EPSS: 1%CPEs: 11EXPL: 0CVE-2017-5334 – gnutls: Double-free while decoding crafted X.509 certificates
https://notcve.org/view.php?id=CVE-2017-5334
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension. La vulnerabilidad de liberación doble en la función gnutls_x509_ext_import_proxy de GnuTLS en versiones anteriores a 3.3.26 y 3.5.x en versiones anteriores a 3.5.8 permite a los atacantes remotos tener un impacto no especificado a través de una información de lenguaje de directivas elaborada en un certificado X.509 con una extensión Proxy Certificate Information. A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could create a specially-crafted certificate which, when processed by an application compiled against GnuTLS, could cause that application to crash. • http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html http://www.openwall.com/lists/oss-security/2017/01/10/7 http://www.openwall.com/lists/oss-security/2017/01/11/4 http://www.securityfocus.com/bid/95370 http://www.securitytracker.com/id/1037576 https://access.redhat.com/errata/RHSA-2017:2292 https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b https://gnutls.org/security.html#GNUTLS-SA-2017-1 https://security.gentoo.org/glsa/201702 • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 7.5EPSS: 3%CPEs: 11EXPL: 0CVE-2017-5335 – gnutls: Out of memory while parsing crafted OpenPGP certificate
https://notcve.org/view.php?id=CVE-2017-5335
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate. Las funciones de lectura de flujo en lib/opencdk/read-packet.c en GnuTLS en versiones anteriores a 3.3.26 y 3.5.x en versiones anteriores a 3.5.8 permiten a atacantes remotos provocar una denegación de servicio (fallo de memoria y error) Certificado OpenPGP. • http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html http://rhn.redhat.com/errata/RHSA-2017-0574.html http://www.openwall.com/lists/oss-security/2017/01/10/7 http://www.openwall.com/lists/oss-security/2017/01/11/4 http://www.securityfocus.com/bid/95374 http://www.securitytracker.com/id/1037576 https://access.redhat.com/errata/RHSA-2017:2292 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=337 https://gitlab.com/gnutls/gnutls/commit/ • CWE-125: Out-of-bounds Read CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2017-5336 – gnutls: Stack overflow in cdk_pk_get_keyid
https://notcve.org/view.php?id=CVE-2017-5336
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate. El desbordamiento de búfer basado en la pila en la función cdk_pk_get_keyid en lib/opencdk/pubkey.c en GnuTLS en versiones anteriores a 3.3.26 y 3.5.x en versiones anteriores a 3.5.8 permite a atacantes remotos tener un impacto no especificado a través de un certificado OpenPGP manipulado. • http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html http://rhn.redhat.com/errata/RHSA-2017-0574.html http://www.openwall.com/lists/oss-security/2017/01/10/7 http://www.openwall.com/lists/oss-security/2017/01/11/4 http://www.securityfocus.com/bid/95377 http://www.securitytracker.com/id/1037576 https://access.redhat.com/errata/RHSA-2017:2292 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340 https://gitlab.com/gnutls/gnutls/commit/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2017-5337 – gnutls: Heap read overflow in read-packet.c
https://notcve.org/view.php?id=CVE-2017-5337
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate. Múltiples desbordamientos de búfer basados en memoria dinámica en la función read_attribute en GnuTLS en versiones anteriores a 3.3.26 y 3.5.x en versiones anteriores a 3.5.8 permiten a los atacantes remotos tener un impacto no especificado a través de un certificado OpenPGP manipulado. • http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html http://rhn.redhat.com/errata/RHSA-2017-0574.html http://www.openwall.com/lists/oss-security/2017/01/10/7 http://www.openwall.com/lists/oss-security/2017/01/11/4 http://www.securityfocus.com/bid/95372 http://www.securitytracker.com/id/1037576 https://access.redhat.com/errata/RHSA-2017:2292 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=338 https://bugs.chromium.org/p/oss-fuzz/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2016-7444 – gnutls: Incorrect certificate validation when using OCSP responses (GNUTLS-SA-2016-3)
https://notcve.org/view.php?id=CVE-2016-7444
The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc. La función gnutls_ocsp_resp_check_crt en lib/x509/ocsp.c en GnuTLS en versiones anteriores a 3.4.15 y 3.5.x en versiones anteriores a 3.5.4 no verifica la longitud de serie de una respuesta OCSP, lo que podría permitir a atacantes remotos eludir un mecanismo de validación destinada a certificados a través de vectores que involucran bytes finales dejados por gnutls_malloc. A flaw was found in the way GnuTLS validated certificates using OCSP responses. This could falsely report a certificate as valid under certain circumstances. • http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html http://www.securityfocus.com/bid/92893 https://access.redhat.com/errata/RHSA-2017:2292 https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9 https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html https://www.gnutls.org/security.html https://access.redhat.com/security/cve/CVE-2016-7444 https://bugzilla.redhat.com/show_bug.cgi?id=1374266 • CWE-264: Permissions, Privileges, and Access Controls CWE-295: Improper Certificate Validation •