Vulnerability-Lookup

RHSA-2017:2292

Vulnerability from csaf_opensuse - Published: 2017-08-01 00:00 - Updated: 2026-09-20 10:59

Summary

security update for gnutls

Severity

Moderate

Notes

Title of the patch: security update for gnutls

Description of the patch: This security update provides a functional equivalent of RHSA-2017:2292. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2017:2292.

Patchnames: RHSA-2017:2292

CVE-2016-7444

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 9 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64	—	Vendor Fix

Threats

Impact low

CVE-2017-5334

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 9 products, the same list as for CVE-2016-7444

Threats

Impact moderate

CVE-2017-5335

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 9 products, the same list as for CVE-2016-7444

Threats

Impact moderate

CVE-2017-5336

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 9 products, the same list as for CVE-2016-7444

Threats

Impact moderate

CVE-2017-5337

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 9 products, the same list as for CVE-2016-7444

Threats

Impact moderate

CVE-2017-7507

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 9 products, the same list as for CVE-2016-7444

Threats

Impact low

CVE-2017-7869

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 9 products, the same list as for CVE-2016-7444

Threats

Impact moderate

References

29 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://www.suse.com/security/cve/CVE-2016-7444/	self
https://www.suse.com/security/cve/CVE-2017-5334/	self
https://www.suse.com/security/cve/CVE-2017-5335/	self
https://www.suse.com/security/cve/CVE-2017-5336/	self
https://www.suse.com/security/cve/CVE-2017-5337/	self
https://www.suse.com/security/cve/CVE-2017-7507/	self
https://www.suse.com/security/cve/CVE-2017-7869/	self
https://www.suse.com/security/cve/CVE-2016-7444	external
https://bugzilla.suse.com/999646	external
https://www.suse.com/security/cve/CVE-2017-5334	external
https://bugzilla.suse.com/1018831	external
https://www.suse.com/security/cve/CVE-2017-5335	external
https://bugzilla.suse.com/1018832	external
https://bugzilla.suse.com/1021057	external
https://www.suse.com/security/cve/CVE-2017-5336	external
https://bugzilla.suse.com/1018832	external
https://bugzilla.suse.com/1021057	external
https://www.suse.com/security/cve/CVE-2017-5337	external
https://bugzilla.suse.com/1018832	external
https://bugzilla.suse.com/1021057	external
https://www.suse.com/security/cve/CVE-2017-7507	external
https://bugzilla.suse.com/1043398	external
https://www.suse.com/security/cve/CVE-2017-7869	external
https://bugzilla.suse.com/1034173	external
https://bugzilla.suse.com/1038337	external
https://bugzilla.suse.com/1049210	external
https://bugzilla.suse.com/1149679	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for gnutls",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2017:2292.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2017:2292.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2017:2292",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2017_2292.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-7444 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-7444/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5334 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5334/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5335 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5335/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5336 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5336/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5337 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5337/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-7507 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-7507/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-7869 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-7869/"
      }
    ],
    "title": "security update for gnutls",
    "tracking": {
      "current_release_date": "2026-09-20T10:59:22Z",
      "generator": {
        "date": "2017-08-01T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2017:2292",
      "initial_release_date": "2017-08-01T00:00:00Z",
      "revision_history": [
        {
          "date": "2017-08-01T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T10:59:22Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gnutls-0:3.3.26-9.el7.i686",
                "product": {
                  "name": "gnutls-0:3.3.26-9.el7.i686",
                  "product_id": "gnutls-0:3.3.26-9.el7.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:gnutls:3.3.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gnutls@3.3.26-9.el7?arch=i686\u0026upstream=gnutls-0:3.3.26-9.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnutls-c++-0:3.3.26-9.el7.i686",
                "product": {
                  "name": "gnutls-c++-0:3.3.26-9.el7.i686",
                  "product_id": "gnutls-c++-0:3.3.26-9.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gnutls-c++@3.3.26-9.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnutls-dane-0:3.3.26-9.el7.i686",
                "product": {
                  "name": "gnutls-dane-0:3.3.26-9.el7.i686",
                  "product_id": "gnutls-dane-0:3.3.26-9.el7.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gnutls-dane@3.3.26-9.el7?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnutls-devel-0:3.3.26-9.el7.i686",
                "product": {
                  "name": "gnutls-devel-0:3.3.26-9.el7.i686",
                  "product_id": "gnutls-devel-0:3.3.26-9.el7.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:gnutls:3.3.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gnutls-devel@3.3.26-9.el7?arch=i686\u0026upstream=gnutls-0:3.3.26-9.el7.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gnutls-0:3.3.26-9.el7.x86_64",
                "product": {
                  "name": "gnutls-0:3.3.26-9.el7.x86_64",
                  "product_id": "gnutls-0:3.3.26-9.el7.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:gnutls:3.3.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gnutls@3.3.26-9.el7?arch=x86_64\u0026upstream=gnutls-0:3.3.26-9.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnutls-c++-0:3.3.26-9.el7.x86_64",
                "product": {
                  "name": "gnutls-c++-0:3.3.26-9.el7.x86_64",
                  "product_id": "gnutls-c++-0:3.3.26-9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gnutls-c++@3.3.26-9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnutls-dane-0:3.3.26-9.el7.x86_64",
                "product": {
                  "name": "gnutls-dane-0:3.3.26-9.el7.x86_64",
                  "product_id": "gnutls-dane-0:3.3.26-9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gnutls-dane@3.3.26-9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnutls-devel-0:3.3.26-9.el7.x86_64",
                "product": {
                  "name": "gnutls-devel-0:3.3.26-9.el7.x86_64",
                  "product_id": "gnutls-devel-0:3.3.26-9.el7.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:gnutls:3.3.26:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gnutls-devel@3.3.26-9.el7?arch=x86_64\u0026upstream=gnutls-0:3.3.26-9.el7.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gnutls-utils-0:3.3.26-9.el7.x86_64",
                "product": {
                  "name": "gnutls-utils-0:3.3.26-9.el7.x86_64",
                  "product_id": "gnutls-utils-0:3.3.26-9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/gnutls-utils@3.3.26-9.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 7",
                "product": {
                  "name": "SUSE Liberty Linux 7",
                  "product_id": "SUSE Liberty Linux 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnutls-0:3.3.26-9.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686"
        },
        "product_reference": "gnutls-0:3.3.26-9.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnutls-0:3.3.26-9.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64"
        },
        "product_reference": "gnutls-0:3.3.26-9.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnutls-c++-0:3.3.26-9.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686"
        },
        "product_reference": "gnutls-c++-0:3.3.26-9.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnutls-c++-0:3.3.26-9.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64"
        },
        "product_reference": "gnutls-c++-0:3.3.26-9.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnutls-dane-0:3.3.26-9.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686"
        },
        "product_reference": "gnutls-dane-0:3.3.26-9.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnutls-dane-0:3.3.26-9.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64"
        },
        "product_reference": "gnutls-dane-0:3.3.26-9.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnutls-devel-0:3.3.26-9.el7.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686"
        },
        "product_reference": "gnutls-devel-0:3.3.26-9.el7.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnutls-devel-0:3.3.26-9.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64"
        },
        "product_reference": "gnutls-devel-0:3.3.26-9.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gnutls-utils-0:3.3.26-9.el7.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
        },
        "product_reference": "gnutls-utils-0:3.3.26-9.el7.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-7444",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-7444"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-7444",
          "url": "https://www.suse.com/security/cve/CVE-2016-7444"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 999646 for CVE-2016-7444",
          "url": "https://bugzilla.suse.com/999646"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-08-01T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2016-7444"
    },
    {
      "cve": "CVE-2017-5334",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5334"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5334",
          "url": "https://www.suse.com/security/cve/CVE-2017-5334"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1018831 for CVE-2017-5334",
          "url": "https://bugzilla.suse.com/1018831"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-08-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5334"
    },
    {
      "cve": "CVE-2017-5335",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5335"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5335",
          "url": "https://www.suse.com/security/cve/CVE-2017-5335"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1018832 for CVE-2017-5335",
          "url": "https://bugzilla.suse.com/1018832"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1021057 for CVE-2017-5335",
          "url": "https://bugzilla.suse.com/1021057"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-08-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5335"
    },
    {
      "cve": "CVE-2017-5336",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5336"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5336",
          "url": "https://www.suse.com/security/cve/CVE-2017-5336"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1018832 for CVE-2017-5336",
          "url": "https://bugzilla.suse.com/1018832"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1021057 for CVE-2017-5336",
          "url": "https://bugzilla.suse.com/1021057"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-08-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5336"
    },
    {
      "cve": "CVE-2017-5337",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5337"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5337",
          "url": "https://www.suse.com/security/cve/CVE-2017-5337"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1018832 for CVE-2017-5337",
          "url": "https://bugzilla.suse.com/1018832"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1021057 for CVE-2017-5337",
          "url": "https://bugzilla.suse.com/1021057"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-08-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5337"
    },
    {
      "cve": "CVE-2017-7507",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-7507"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-7507",
          "url": "https://www.suse.com/security/cve/CVE-2017-7507"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1043398 for CVE-2017-7507",
          "url": "https://bugzilla.suse.com/1043398"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-08-01T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2017-7507"
    },
    {
      "cve": "CVE-2017-7869",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-7869"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor\u0027s GNUTLS-SA-2017-3 report) is fixed in 3.5.10.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
          "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
          "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-7869",
          "url": "https://www.suse.com/security/cve/CVE-2017-7869"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1034173 for CVE-2017-7869",
          "url": "https://bugzilla.suse.com/1034173"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1038337 for CVE-2017-7869",
          "url": "https://bugzilla.suse.com/1038337"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1049210 for CVE-2017-7869",
          "url": "https://bugzilla.suse.com/1049210"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1149679 for CVE-2017-7869",
          "url": "https://bugzilla.suse.com/1149679"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-c++-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-dane-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.i686",
            "SUSE Liberty Linux 7:gnutls-devel-0:3.3.26-9.el7.x86_64",
            "SUSE Liberty Linux 7:gnutls-utils-0:3.3.26-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-08-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-7869"
    }
  ]
}

CVE-2016-7444 (GCVE-0-2016-7444)

Vulnerability from cvelistv5 – Published: 2016-09-27 15:00 – Updated: 2024-08-06 01:57

Summary

The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.

Severity

No CVSS data available.

CWE

Assigner

debian mitre root

References

6 references

URL	Tags
http://www.securityfocus.com/bid/92893	vdb-entryx_refsource_BID
https://gitlab.com/gnutls/gnutls/commit/964632f37…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:2292	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://lists.gnupg.org/pipermail/gnutls-devel/20…	mailing-listx_refsource_MLIST
https://www.gnutls.org/security.html	x_refsource_CONFIRM

Date Public

2016-09-02 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:57:47.621Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "92893",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/92893"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9"
          },
          {
            "name": "RHSA-2017:2292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2292"
          },
          {
            "name": "openSUSE-SU-2017:0386",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
          },
          {
            "name": "[gnutls-devel] 20160902 OCSP certificate check",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.gnutls.org/security.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-09-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "references": [
        {
          "name": "92893",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/92893"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9"
        },
        {
          "name": "RHSA-2017:2292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2292"
        },
        {
          "name": "openSUSE-SU-2017:0386",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
        },
        {
          "name": "[gnutls-devel] 20160902 OCSP certificate check",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.gnutls.org/security.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@debian.org",
          "ID": "CVE-2016-7444",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "92893",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/92893"
            },
            {
              "name": "https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9",
              "refsource": "CONFIRM",
              "url": "https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9"
            },
            {
              "name": "RHSA-2017:2292",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2292"
            },
            {
              "name": "openSUSE-SU-2017:0386",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
            },
            {
              "name": "[gnutls-devel] 20160902 OCSP certificate check",
              "refsource": "MLIST",
              "url": "https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html"
            },
            {
              "name": "https://www.gnutls.org/security.html",
              "refsource": "CONFIRM",
              "url": "https://www.gnutls.org/security.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2016-7444",
    "datePublished": "2016-09-27T15:00:00.000Z",
    "dateReserved": "2016-09-09T00:00:00.000Z",
    "dateUpdated": "2024-08-06T01:57:47.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5334 (GCVE-0-2017-5334)

Vulnerability from cvelistv5 – Published: 2017-03-24 15:00 – Updated: 2024-08-05 14:55

Summary

Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.

Severity

No CVSS data available.

CWE

Assigner

debian mitre root

References

9 references

URL	Tags
http://www.openwall.com/lists/oss-security/2017/01/10/7	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2017:2292	vendor-advisoryx_refsource_REDHAT
http://www.securitytracker.com/id/1037576	vdb-entryx_refsource_SECTRACK
http://www.openwall.com/lists/oss-security/2017/01/11/4	mailing-listx_refsource_MLIST
https://gnutls.org/security.html#GNUTLS-SA-2017-1	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/95370	vdb-entryx_refsource_BID
https://security.gentoo.org/glsa/201702-04	vendor-advisoryx_refsource_GENTOO
https://gitlab.com/gnutls/gnutls/commit/c5aaa488a…	x_refsource_CONFIRM

Date Public

2017-01-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:55:35.773Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
          },
          {
            "name": "RHSA-2017:2292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2292"
          },
          {
            "name": "1037576",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037576"
          },
          {
            "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-1"
          },
          {
            "name": "openSUSE-SU-2017:0386",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
          },
          {
            "name": "95370",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95370"
          },
          {
            "name": "GLSA-201702-04",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201702-04"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "references": [
        {
          "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
        },
        {
          "name": "RHSA-2017:2292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2292"
        },
        {
          "name": "1037576",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037576"
        },
        {
          "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-1"
        },
        {
          "name": "openSUSE-SU-2017:0386",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
        },
        {
          "name": "95370",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95370"
        },
        {
          "name": "GLSA-201702-04",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201702-04"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@debian.org",
          "ID": "CVE-2017-5334",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
            },
            {
              "name": "RHSA-2017:2292",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2292"
            },
            {
              "name": "1037576",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037576"
            },
            {
              "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
            },
            {
              "name": "https://gnutls.org/security.html#GNUTLS-SA-2017-1",
              "refsource": "CONFIRM",
              "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-1"
            },
            {
              "name": "openSUSE-SU-2017:0386",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
            },
            {
              "name": "95370",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95370"
            },
            {
              "name": "GLSA-201702-04",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201702-04"
            },
            {
              "name": "https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b",
              "refsource": "CONFIRM",
              "url": "https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2017-5334",
    "datePublished": "2017-03-24T15:00:00.000Z",
    "dateReserved": "2017-01-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T14:55:35.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5335 (GCVE-0-2017-5335)

Vulnerability from cvelistv5 – Published: 2017-03-24 15:00 – Updated: 2024-08-05 14:55

Summary

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.

Severity

No CVSS data available.

CWE

Assigner

debian mitre root

References

11 references

URL	Tags
http://www.openwall.com/lists/oss-security/2017/01/10/7	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2017:2292	vendor-advisoryx_refsource_REDHAT
http://www.securitytracker.com/id/1037576	vdb-entryx_refsource_SECTRACK
http://www.openwall.com/lists/oss-security/2017/01/11/4	mailing-listx_refsource_MLIST
https://bugs.chromium.org/p/oss-fuzz/issues/detai…	x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2017-0574.html	vendor-advisoryx_refsource_REDHAT
https://security.gentoo.org/glsa/201702-04	vendor-advisoryx_refsource_GENTOO
https://gnutls.org/security.html#GNUTLS-SA-2017-2	x_refsource_CONFIRM
https://gitlab.com/gnutls/gnutls/commit/49be4f7b8…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/95374	vdb-entryx_refsource_BID

Date Public

2017-01-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:55:35.773Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
          },
          {
            "name": "RHSA-2017:2292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2292"
          },
          {
            "name": "1037576",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037576"
          },
          {
            "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=337"
          },
          {
            "name": "openSUSE-SU-2017:0386",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
          },
          {
            "name": "RHSA-2017:0574",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0574.html"
          },
          {
            "name": "GLSA-201702-04",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201702-04"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gitlab.com/gnutls/gnutls/commit/49be4f7b82eba2363bb8d4090950dad976a77a3a"
          },
          {
            "name": "95374",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95374"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "references": [
        {
          "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
        },
        {
          "name": "RHSA-2017:2292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2292"
        },
        {
          "name": "1037576",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037576"
        },
        {
          "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=337"
        },
        {
          "name": "openSUSE-SU-2017:0386",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
        },
        {
          "name": "RHSA-2017:0574",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0574.html"
        },
        {
          "name": "GLSA-201702-04",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201702-04"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gitlab.com/gnutls/gnutls/commit/49be4f7b82eba2363bb8d4090950dad976a77a3a"
        },
        {
          "name": "95374",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95374"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@debian.org",
          "ID": "CVE-2017-5335",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
            },
            {
              "name": "RHSA-2017:2292",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2292"
            },
            {
              "name": "1037576",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037576"
            },
            {
              "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
            },
            {
              "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=337",
              "refsource": "MISC",
              "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=337"
            },
            {
              "name": "openSUSE-SU-2017:0386",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
            },
            {
              "name": "RHSA-2017:0574",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2017-0574.html"
            },
            {
              "name": "GLSA-201702-04",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201702-04"
            },
            {
              "name": "https://gnutls.org/security.html#GNUTLS-SA-2017-2",
              "refsource": "CONFIRM",
              "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-2"
            },
            {
              "name": "https://gitlab.com/gnutls/gnutls/commit/49be4f7b82eba2363bb8d4090950dad976a77a3a",
              "refsource": "CONFIRM",
              "url": "https://gitlab.com/gnutls/gnutls/commit/49be4f7b82eba2363bb8d4090950dad976a77a3a"
            },
            {
              "name": "95374",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95374"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2017-5335",
    "datePublished": "2017-03-24T15:00:00.000Z",
    "dateReserved": "2017-01-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T14:55:35.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5336 (GCVE-0-2017-5336)

Vulnerability from cvelistv5 – Published: 2017-03-24 15:00 – Updated: 2024-08-05 14:55

Summary

Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.

Severity

No CVSS data available.

CWE

Assigner

debian mitre root

References

11 references

URL	Tags
https://gitlab.com/gnutls/gnutls/commit/5140422e0…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/95377	vdb-entryx_refsource_BID
http://www.openwall.com/lists/oss-security/2017/01/10/7	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2017:2292	vendor-advisoryx_refsource_REDHAT
http://www.securitytracker.com/id/1037576	vdb-entryx_refsource_SECTRACK
http://www.openwall.com/lists/oss-security/2017/01/11/4	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://bugs.chromium.org/p/oss-fuzz/issues/detai…	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2017-0574.html	vendor-advisoryx_refsource_REDHAT
https://security.gentoo.org/glsa/201702-04	vendor-advisoryx_refsource_GENTOO
https://gnutls.org/security.html#GNUTLS-SA-2017-2	x_refsource_CONFIRM

Date Public

2017-01-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:55:35.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gitlab.com/gnutls/gnutls/commit/5140422e0d7319a8e2fe07f02cbcafc4d6538732"
          },
          {
            "name": "95377",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95377"
          },
          {
            "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
          },
          {
            "name": "RHSA-2017:2292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2292"
          },
          {
            "name": "1037576",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037576"
          },
          {
            "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
          },
          {
            "name": "openSUSE-SU-2017:0386",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340"
          },
          {
            "name": "RHSA-2017:0574",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0574.html"
          },
          {
            "name": "GLSA-201702-04",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201702-04"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gitlab.com/gnutls/gnutls/commit/5140422e0d7319a8e2fe07f02cbcafc4d6538732"
        },
        {
          "name": "95377",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95377"
        },
        {
          "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
        },
        {
          "name": "RHSA-2017:2292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2292"
        },
        {
          "name": "1037576",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037576"
        },
        {
          "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
        },
        {
          "name": "openSUSE-SU-2017:0386",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340"
        },
        {
          "name": "RHSA-2017:0574",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0574.html"
        },
        {
          "name": "GLSA-201702-04",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201702-04"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-2"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@debian.org",
          "ID": "CVE-2017-5336",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://gitlab.com/gnutls/gnutls/commit/5140422e0d7319a8e2fe07f02cbcafc4d6538732",
              "refsource": "CONFIRM",
              "url": "https://gitlab.com/gnutls/gnutls/commit/5140422e0d7319a8e2fe07f02cbcafc4d6538732"
            },
            {
              "name": "95377",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95377"
            },
            {
              "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
            },
            {
              "name": "RHSA-2017:2292",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2292"
            },
            {
              "name": "1037576",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037576"
            },
            {
              "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
            },
            {
              "name": "openSUSE-SU-2017:0386",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
            },
            {
              "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340",
              "refsource": "MISC",
              "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340"
            },
            {
              "name": "RHSA-2017:0574",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2017-0574.html"
            },
            {
              "name": "GLSA-201702-04",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201702-04"
            },
            {
              "name": "https://gnutls.org/security.html#GNUTLS-SA-2017-2",
              "refsource": "CONFIRM",
              "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-2"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2017-5336",
    "datePublished": "2017-03-24T15:00:00.000Z",
    "dateReserved": "2017-01-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T14:55:35.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5337 (GCVE-0-2017-5337)

Vulnerability from cvelistv5 – Published: 2017-03-24 15:00 – Updated: 2024-08-05 14:55

Summary

Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.

Severity

No CVSS data available.

CWE

Assigner

debian mitre root

References

12 references

URL	Tags
http://www.openwall.com/lists/oss-security/2017/01/10/7	mailing-listx_refsource_MLIST
https://access.redhat.com/errata/RHSA-2017:2292	vendor-advisoryx_refsource_REDHAT
http://www.securitytracker.com/id/1037576	vdb-entryx_refsource_SECTRACK
http://www.openwall.com/lists/oss-security/2017/01/11/4	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/95372	vdb-entryx_refsource_BID
http://rhn.redhat.com/errata/RHSA-2017-0574.html	vendor-advisoryx_refsource_REDHAT
https://security.gentoo.org/glsa/201702-04	vendor-advisoryx_refsource_GENTOO
https://gnutls.org/security.html#GNUTLS-SA-2017-2	x_refsource_CONFIRM
https://gitlab.com/gnutls/gnutls/commit/94fcf1645…	x_refsource_CONFIRM
https://bugs.chromium.org/p/oss-fuzz/issues/detai…	x_refsource_MISC
https://bugs.chromium.org/p/oss-fuzz/issues/detai…	x_refsource_MISC

Date Public

2017-01-09 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:55:35.701Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
          },
          {
            "name": "RHSA-2017:2292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2292"
          },
          {
            "name": "1037576",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037576"
          },
          {
            "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
          },
          {
            "name": "openSUSE-SU-2017:0386",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
          },
          {
            "name": "95372",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95372"
          },
          {
            "name": "RHSA-2017:0574",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0574.html"
          },
          {
            "name": "GLSA-201702-04",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201702-04"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://gitlab.com/gnutls/gnutls/commit/94fcf1645ea17223237aaf8d19132e004afddc1a"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=338"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=346"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "references": [
        {
          "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
        },
        {
          "name": "RHSA-2017:2292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2292"
        },
        {
          "name": "1037576",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037576"
        },
        {
          "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
        },
        {
          "name": "openSUSE-SU-2017:0386",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
        },
        {
          "name": "95372",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95372"
        },
        {
          "name": "RHSA-2017:0574",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0574.html"
        },
        {
          "name": "GLSA-201702-04",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201702-04"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://gitlab.com/gnutls/gnutls/commit/94fcf1645ea17223237aaf8d19132e004afddc1a"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=338"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=346"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@debian.org",
          "ID": "CVE-2017-5337",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/01/10/7"
            },
            {
              "name": "RHSA-2017:2292",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2292"
            },
            {
              "name": "1037576",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037576"
            },
            {
              "name": "[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2017/01/11/4"
            },
            {
              "name": "openSUSE-SU-2017:0386",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html"
            },
            {
              "name": "95372",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95372"
            },
            {
              "name": "RHSA-2017:0574",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2017-0574.html"
            },
            {
              "name": "GLSA-201702-04",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201702-04"
            },
            {
              "name": "https://gnutls.org/security.html#GNUTLS-SA-2017-2",
              "refsource": "CONFIRM",
              "url": "https://gnutls.org/security.html#GNUTLS-SA-2017-2"
            },
            {
              "name": "https://gitlab.com/gnutls/gnutls/commit/94fcf1645ea17223237aaf8d19132e004afddc1a",
              "refsource": "CONFIRM",
              "url": "https://gitlab.com/gnutls/gnutls/commit/94fcf1645ea17223237aaf8d19132e004afddc1a"
            },
            {
              "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=338",
              "refsource": "MISC",
              "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=338"
            },
            {
              "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=346",
              "refsource": "MISC",
              "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=346"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2017-5337",
    "datePublished": "2017-03-24T15:00:00.000Z",
    "dateReserved": "2017-01-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T14:55:35.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7507 (GCVE-0-2017-7507)

Vulnerability from cvelistv5 – Published: 2017-06-16 19:00 – Updated: 2024-08-05 16:04

Summary

GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application.

Severity

No CVSS data available.

CWE

NULL pointer dereference

Assigner

redhat redhat root

References

4 references

URL	Tags
http://www.securityfocus.com/bid/99102	vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2017:2292	vendor-advisoryx_refsource_REDHAT
https://www.gnutls.org/security.html#GNUTLS-SA-2017-4	x_refsource_CONFIRM
http://www.debian.org/security/2017/dsa-3884	vendor-advisoryx_refsource_DEBIAN

Impacted products

1 product

Vendor	Product	Version
GnuTLS	gnutls	Affected: 3.5.12

Date Public

2017-06-08 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:04:11.924Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "99102",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/99102"
          },
          {
            "name": "RHSA-2017:2292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2292"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.gnutls.org/security.html#GNUTLS-SA-2017-4"
          },
          {
            "name": "DSA-3884",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3884"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gnutls",
          "vendor": "GnuTLS",
          "versions": [
            {
              "status": "affected",
              "version": "3.5.12"
            }
          ]
        }
      ],
      "datePublic": "2017-06-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "NULL pointer dereference",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "99102",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/99102"
        },
        {
          "name": "RHSA-2017:2292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2292"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.gnutls.org/security.html#GNUTLS-SA-2017-4"
        },
        {
          "name": "DSA-3884",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3884"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2017-7507",
    "datePublished": "2017-06-16T19:00:00.000Z",
    "dateReserved": "2017-04-05T00:00:00.000Z",
    "dateUpdated": "2024-08-05T16:04:11.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-7869 (GCVE-0-2017-7869)

Vulnerability from cvelistv5 – Published: 2017-04-14 04:30 – Updated: 2024-08-05 16:19

Summary

GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

5 references

URL	Tags
https://bugs.chromium.org/p/oss-fuzz/issues/detai…	x_refsource_MISC
https://gitlab.com/gnutls/gnutls/commit/51464af71…	x_refsource_MISC
https://access.redhat.com/errata/RHSA-2017:2292	vendor-advisoryx_refsource_REDHAT
https://www.gnutls.org/security.html	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97040	vdb-entryx_refsource_BID

Date Public

2017-04-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:19:29.291Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gitlab.com/gnutls/gnutls/commit/51464af713d71802e3c6d5ac15f1a95132a354fe"
          },
          {
            "name": "RHSA-2017:2292",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2292"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.gnutls.org/security.html"
          },
          {
            "name": "97040",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97040"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-04-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor\u0027s GNUTLS-SA-2017-3 report) is fixed in 3.5.10."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.com/gnutls/gnutls/commit/51464af713d71802e3c6d5ac15f1a95132a354fe"
        },
        {
          "name": "RHSA-2017:2292",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2292"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.gnutls.org/security.html"
        },
        {
          "name": "97040",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97040"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-7869",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor\u0027s GNUTLS-SA-2017-3 report) is fixed in 3.5.10."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420",
              "refsource": "MISC",
              "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420"
            },
            {
              "name": "https://gitlab.com/gnutls/gnutls/commit/51464af713d71802e3c6d5ac15f1a95132a354fe",
              "refsource": "MISC",
              "url": "https://gitlab.com/gnutls/gnutls/commit/51464af713d71802e3c6d5ac15f1a95132a354fe"
            },
            {
              "name": "RHSA-2017:2292",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2292"
            },
            {
              "name": "https://www.gnutls.org/security.html",
              "refsource": "CONFIRM",
              "url": "https://www.gnutls.org/security.html"
            },
            {
              "name": "97040",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97040"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-7869",
    "datePublished": "2017-04-14T04:30:00.000Z",
    "dateReserved": "2017-04-14T00:00:00.000Z",
    "dateUpdated": "2024-08-05T16:19:29.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2017:2292

CVE-2016-7444 (GCVE-0-2016-7444)

CVE-2017-5334 (GCVE-0-2017-5334)

CVE-2017-5335 (GCVE-0-2017-5335)

CVE-2017-5336 (GCVE-0-2017-5336)

CVE-2017-5337 (GCVE-0-2017-5337)

CVE-2017-7507 (GCVE-0-2017-7507)

CVE-2017-7869 (GCVE-0-2017-7869)

Tags

Sightings

Nomenclature

Related by attack behaviour