Published: 24/08/2015 Updated: 24/12/2016

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Double free vulnerability in GnuTLS prior to 3.3.17 and 3.4.x prior to 3.4.4 allows remote malicious users to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu gnutls 3.3.16
gnu gnutls 3.3.15
gnu gnutls 3.3.8
gnu gnutls 3.3.7
gnu gnutls 3.3.0
gnu gnutls 3.3.12
gnu gnutls 3.3.11
gnu gnutls 3.3.4
gnu gnutls 3.3.3
gnu gnutls 3.4.3
gnu gnutls 3.3.10
gnu gnutls 3.3.9
gnu gnutls 3.3.2
gnu gnutls 3.3.1
gnu gnutls 3.3.14
gnu gnutls 3.3.13
gnu gnutls 3.3.6
gnu gnutls 3.3.5
gnu gnutls 3.4.0
gnu gnutls 3.4.1
gnu gnutls 3.4.2
debian debian linux 8.0

GnuTLS could be made to crash or run programs if it processed a specially crafted certificate ...

Kurt Roeckx discovered that decoding a specific certificate with very long DistinguishedName (DN) entries leads to double free A remote attacker can take advantage of this flaw by creating a specially crafted certificate that, when processed by an application compiled against GnuTLS, could cause the application to crash resulting in a denial of se ...

A use-after-free flaw was found in GnuTLS's _gnutls_x509_dn_to_string() function A remote attacker could create a specially crafted certificate with very long DistinguishedName (DN) entries that, when processed by an application compiled against GnuTLS, could cause that application to crash ...

NVD-CWE-Other http://www.openwall.com/lists/oss-security/2015/08/17/6 http://www.debian.org/security/2015/dsa-3334 https://bugzilla.redhat.com/show_bug.cgi?id=1251902 http://www.openwall.com/lists/oss-security/2015/08/10/1 https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12 http://www.gnutls.org/security.html#GNUTLS-SA-2015-3 http://www.securityfocus.com/bid/76267 http://lists.opensuse.org/opensuse-updates/2015-09/msg00001.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165286.html http://www.securitytracker.com/id/1033226 https://usn.ubuntu.com/2727-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-6251

CVE-2015-6251

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect