Published: 08/12/2011 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x prior to 2.12.14 and 3.x prior to 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service (application crash) via a large SessionTicket.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu gnutls 2.12.2
gnu gnutls 2.12.7
gnu gnutls 2.12.5
gnu gnutls 2.12.8
gnu gnutls 2.12.6.1
gnu gnutls 2.12.0
gnu gnutls 2.12.10
gnu gnutls 2.12.6
gnu gnutls 2.12.9
gnu gnutls 2.12.13
gnu gnutls 2.12.12
gnu gnutls 2.12.3
gnu gnutls 2.12.4
gnu gnutls 2.12.11
gnu gnutls 2.12.1
gnu gnutls 3.0.3
gnu gnutls 3.0.6
gnu gnutls 3.0.0
gnu gnutls 3.0.2
gnu gnutls 3.0.5
gnu gnutls 3.0.1
gnu gnutls 3.0.4

The GnuTLS library could be made to crash under certain conditions ...

Synopsis Important: gnutls security update Type/Severity Security Advisory: Important Topic Updated gnutls packages that fix two security issues are now available forRed Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerability S ...

Synopsis Important: gnutls security update Type/Severity Security Advisory: Important Topic Updated gnutls packages that fix three security issues are now availablefor Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerability ...

A flaw was found in the way GnuTLS decrypted malformed TLS records This could cause a TLS/SSL client or server to crash when processing a specially-crafted TLS record from a remote TLS/SSL connection peer (CVE-2012-1573) A boundary error was found in the gnutls_session_get_data() function A malicious TLS/SSL server could use this flaw to crash a ...

CWE-119 http://www.gnu.org/software/gnutls/security.html http://openwall.com/lists/oss-security/2011/11/09/4 https://bugzilla.redhat.com/show_bug.cgi?id=752308 http://openwall.com/lists/oss-security/2011/11/09/2 http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596 http://secunia.com/advisories/48596 http://rhn.redhat.com/errata/RHSA-2012-0429.html http://www.ubuntu.com/usn/USN-1418-1 http://secunia.com/advisories/48712 http://rhn.redhat.com/errata/RHSA-2012-0531.html http://rhn.redhat.com/errata/RHSA-2012-0488.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077071.html http://www.mandriva.com/security/advisories?name=MDVSA-2012:045 http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=e82ef4545e9e98cbcb032f55d7c750b81e3a0450 http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=190cef6eed37d0e73a73c1e205eb31d45ab60a3c https://usn.ubuntu.com/1418-1/https://nvd.nist.gov

CVE-2011-4128

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect