GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
usn-3183-1
Vulnerability from osv_ubuntu
Published
2017-02-01 17:56
Modified
2026-04-22 07:36
Summary
gnutls26, gnutls28 vulnerabilities
Details

Stefan Buehler discovered that GnuTLS incorrectly verified the serial length of OCSP responses. A remote attacker could possibly use this issue to bypass certain certificate validation measures. This issue only applied to Ubuntu 16.04 LTS. (CVE-2016-7444)

Shi Lei discovered that GnuTLS incorrectly handled certain warning alerts. A remote attacker could possibly use this issue to cause GnuTLS to hang, resulting in a denial of service. This issue has only been addressed in Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8610)

It was discovered that GnuTLS incorrectly decoded X.509 certificates with a Proxy Certificate Information extension. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5334)

It was discovered that GnuTLS incorrectly handled certain OpenPGP certificates. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2017-5335",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-5336",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-5337",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gnutls-bin",
            "binary_version": "3.0.11+really2.12.23-12ubuntu2.6"
          },
          {
            "binary_name": "libgnutls-openssl27",
            "binary_version": "2.12.23-12ubuntu2.6"
          },
          {
            "binary_name": "libgnutls26",
            "binary_version": "2.12.23-12ubuntu2.6"
          },
          {
            "binary_name": "libgnutlsxx27",
            "binary_version": "2.12.23-12ubuntu2.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "gnutls26",
        "purl": "pkg:deb/ubuntu/gnutls26@2.12.23-12ubuntu2.6?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.12.23-12ubuntu2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.12.23-1ubuntu4",
        "2.12.23-1ubuntu5",
        "2.12.23-12ubuntu1",
        "2.12.23-12ubuntu2",
        "2.12.23-12ubuntu2.1",
        "2.12.23-12ubuntu2.2",
        "2.12.23-12ubuntu2.3",
        "2.12.23-12ubuntu2.4",
        "2.12.23-12ubuntu2.5"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-7444",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-8610",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-5334",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-5335",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-5336",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-5337",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gnutls-bin",
            "binary_version": "3.4.10-4ubuntu1.2"
          },
          {
            "binary_name": "guile-gnutls",
            "binary_version": "3.4.10-4ubuntu1.2"
          },
          {
            "binary_name": "libgnutls-openssl27",
            "binary_version": "3.4.10-4ubuntu1.2"
          },
          {
            "binary_name": "libgnutls30",
            "binary_version": "3.4.10-4ubuntu1.2"
          },
          {
            "binary_name": "libgnutlsxx28",
            "binary_version": "3.4.10-4ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "gnutls28",
        "purl": "pkg:deb/ubuntu/gnutls28@3.4.10-4ubuntu1.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.10-4ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.3.15-5ubuntu2",
        "3.3.18-1ubuntu1",
        "3.3.20-1ubuntu1",
        "3.4.9-2ubuntu1",
        "3.4.10-4ubuntu1",
        "3.4.10-4ubuntu1.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Stefan Buehler discovered that GnuTLS incorrectly verified the serial\nlength of OCSP responses. A remote attacker could possibly use this issue\nto bypass certain certificate validation measures. This issue only applied\nto Ubuntu 16.04 LTS. (CVE-2016-7444)\n\nShi Lei discovered that GnuTLS incorrectly handled certain warning alerts.\nA remote attacker could possibly use this issue to cause GnuTLS to hang,\nresulting in a denial of service. This issue has only been addressed in\nUbuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8610)\n\nIt was discovered that GnuTLS incorrectly decoded X.509 certificates with a\nProxy Certificate Information extension. A remote attacker could use this\nissue to cause GnuTLS to crash, resulting in a denial of service, or\npossibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS\nand Ubuntu 16.10. (CVE-2017-5334)\n\nIt was discovered that GnuTLS incorrectly handled certain OpenPGP\ncertificates. A remote attacker could possibly use this issue to cause\nGnuTLS to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337)\n",
  "id": "USN-3183-1",
  "modified": "2026-04-22T07:36:33Z",
  "published": "2017-02-01T17:56:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3183-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-7444"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-8610"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-5334"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-5335"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-5336"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-5337"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "gnutls26, gnutls28 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2016-7444",
    "UBUNTU-CVE-2016-8610",
    "UBUNTU-CVE-2017-5334",
    "UBUNTU-CVE-2017-5335",
    "UBUNTU-CVE-2017-5336",
    "UBUNTU-CVE-2017-5337"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.