Arch Linux Security Advisory ASA-201707-6 ========================================= Severity: Medium Date : 2017-07-11 CVE-ID : CVE-2017-7507 Package : lib32-gnutls Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-295 Summary ======= The package lib32-gnutls before version 3.5.13-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.5.13-1. # pacman -Syu "lib32-gnutls>=3.5.13-1" The problem has been fixed upstream in version 3.5.13. Workaround ========== None. Description =========== GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application. Impact ====== A remote attacker can crash a vulnerable TLS server by sending a crafted status_request extension in a ClientHello message. References ========== https://www.gnutls.org/security.html#GNUTLS-SA-2017-4 https://bugzilla.redhat.com/show_bug.cgi?id=1454621 https://security.archlinux.org/CVE-2017-7507