[arch-security] [ASA-201508-8] gnutls: denial of service
rgacogne at archlinux.org
Tue Aug 25 16:06:09 UTC 2015
Arch Linux Security Advisory ASA-201508-8
Date : 2015-08-25
CVE-ID : CVE-2015-6251
Package : gnutls
Type : denial of service
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package gnutls before version 18.104.22.168-1 is vulnerable to remote
denial of service.
Upgrade to 22.214.171.124-1.
# pacman -Syu "gnutls>=126.96.36.199-1"
The problem has been fixed upstream in version 3.4.4 and 3.3.17.
Kurt Roeckx reported that decoding a specific certificate with very long
DistinguishedName (DN) entries leads to double free, which may result to
a denial of service. Since the DN decoding occurs in almost all
applications using certificates it is recommended to upgrade the latest
GnuTLS version fixing the issue.
A remote attacker might be able to remotely crash a vulnerable
application by supplying a crafted certificate with a very long DN.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 801 bytes
Desc: OpenPGP digital signature
More information about the arch-security