CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2017-5336 – gnutls: Stack overflow in cdk_pk_get_keyid
https://notcve.org/view.php?id=CVE-2017-5336
Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate. El desbordamiento de búfer basado en la pila en la función cdk_pk_get_keyid en lib/opencdk/pubkey.c en GnuTLS en versiones anteriores a 3.3.26 y 3.5.x en versiones anteriores a 3.5.8 permite a atacantes remotos tener un impacto no especificado a través de un certificado OpenPGP manipulado. • http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html http://rhn.redhat.com/errata/RHSA-2017-0574.html http://www.openwall.com/lists/oss-security/2017/01/10/7 http://www.openwall.com/lists/oss-security/2017/01/11/4 http://www.securityfocus.com/bid/95377 http://www.securitytracker.com/id/1037576 https://access.redhat.com/errata/RHSA-2017:2292 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340 https://gitlab.com/gnutls/gnutls/commit/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 9.8EPSS: 1%CPEs: 11EXPL: 0CVE-2017-5334 – gnutls: Double-free while decoding crafted X.509 certificates
https://notcve.org/view.php?id=CVE-2017-5334
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension. La vulnerabilidad de liberación doble en la función gnutls_x509_ext_import_proxy de GnuTLS en versiones anteriores a 3.3.26 y 3.5.x en versiones anteriores a 3.5.8 permite a los atacantes remotos tener un impacto no especificado a través de una información de lenguaje de directivas elaborada en un certificado X.509 con una extensión Proxy Certificate Information. A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could create a specially-crafted certificate which, when processed by an application compiled against GnuTLS, could cause that application to crash. • http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html http://www.openwall.com/lists/oss-security/2017/01/10/7 http://www.openwall.com/lists/oss-security/2017/01/11/4 http://www.securityfocus.com/bid/95370 http://www.securitytracker.com/id/1037576 https://access.redhat.com/errata/RHSA-2017:2292 https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b https://gnutls.org/security.html#GNUTLS-SA-2017-1 https://security.gentoo.org/glsa/201702 • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2016-7444 – gnutls: Incorrect certificate validation when using OCSP responses (GNUTLS-SA-2016-3)
https://notcve.org/view.php?id=CVE-2016-7444
The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc. La función gnutls_ocsp_resp_check_crt en lib/x509/ocsp.c en GnuTLS en versiones anteriores a 3.4.15 y 3.5.x en versiones anteriores a 3.5.4 no verifica la longitud de serie de una respuesta OCSP, lo que podría permitir a atacantes remotos eludir un mecanismo de validación destinada a certificados a través de vectores que involucran bytes finales dejados por gnutls_malloc. A flaw was found in the way GnuTLS validated certificates using OCSP responses. This could falsely report a certificate as valid under certain circumstances. • http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html http://www.securityfocus.com/bid/92893 https://access.redhat.com/errata/RHSA-2017:2292 https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9 https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html https://www.gnutls.org/security.html https://access.redhat.com/security/cve/CVE-2016-7444 https://bugzilla.redhat.com/show_bug.cgi?id=1374266 • CWE-264: Permissions, Privileges, and Access Controls CWE-295: Improper Certificate Validation •
CVSS: 5.9EPSS: 4%CPEs: 5EXPL: 0CVE-2015-8313
https://notcve.org/view.php?id=CVE-2015-8313
GnuTLS incorrectly validates the first byte of padding in CBC modes GnuTLS comprueba incorrectamente el primer byte de relleno en los modos CBC • http://www.debian.org/security/2015/dsa-3408 http://www.securityfocus.com/archive/1/537012/100/0/threaded http://www.securityfocus.com/bid/78327 https://blog.hboeck.de/archives/877-A-little-POODLE-left-in-GnuTLS-old-versions.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8313 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2015-8313 https://security-tracker.debian.org/tracker/CVE-2015-8313 • CWE-203: Observable Discrepancy •
CVSS: 5.0EPSS: 18%CPEs: 23EXPL: 0CVE-2015-6251
https://notcve.org/view.php?id=CVE-2015-6251
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate. Vulnerabilidad de liberación doble en GnuTLS en versiones anteriores a la 3.3.17 y 3.4.x versiones anteriores a 3.4.4, permite a atacantes remotos causar una denegación de servicio a través de una entrada DistinguishedName (DN) de gran longitud en un certificado. • http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165286.html http://lists.opensuse.org/opensuse-updates/2015-09/msg00001.html http://www.debian.org/security/2015/dsa-3334 http://www.gnutls.org/security.html#GNUTLS-SA-2015-3 http://www.openwall.com/lists/oss-security/2015/08/10/1 http://www.openwall.com/lists/oss-security/2015/08/17/6 http://www.securityfocus.com/bid/76267 http://www.securitytracker.com/id/1033226 https://bugzilla.redhat.com/show& •