Arch Linux Security Advisory ASA-201706-12 ========================================== Severity: Medium Date : 2017-06-13 CVE-ID : CVE-2017-7507 Package : gnutls Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-294 Summary ======= The package gnutls before version 3.5.13-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.5.13-1. # pacman -Syu "gnutls>=3.5.13-1" The problem has been fixed upstream in version 3.5.13. Workaround ========== None. Description =========== A security issue has been found in GnuTLS < 3.5.13, where decoding a status request TLS extension that has a non-empty responder IDs list could lead to a crash due to a null pointer dereference. Impact ====== A remote attacker can crash a vulnerable TLS server by sending a crafted status_request extension in a ClientHello message. References ========== https://www.gnutls.org/security.html#GNUTLS-SA-2017-4 https://bugzilla.redhat.com/show_bug.cgi?id=1454621 https://security.archlinux.org/CVE-2017-7507