USN-3183-1

Dashboard / Vulnerabilities / USN-3183-1

USN-3183-1

Summary: gnutls26, gnutls28 vulnerabilities

Details: Stefan Buehler discovered that GnuTLS incorrectly verified the serial length of OCSP responses. A remote attacker could possibly use this issue to bypass certain certificate validation measures. This issue only applied to Ubuntu 16.04 LTS. (CVE-2016-7444) Shi Lei discovered that GnuTLS incorrectly handled certain warning alerts. A remote attacker could possibly use this issue to cause GnuTLS to hang, resulting in a denial of service. This issue has only been addressed in Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8610) It was discovered that GnuTLS incorrectly decoded X.509 certificates with a Proxy Certificate Information extension. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5334) It was discovered that GnuTLS incorrectly handled certain OpenPGP certificates. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337)

References: https://ubuntu.com/security/notices/USN-3183-1, https://ubuntu.com/security/CVE-2016-7444, https://ubuntu.com/security/CVE-2016-8610, https://ubuntu.com/security/CVE-2017-5334, https://ubuntu.com/security/CVE-2017-5335, https://ubuntu.com/security/CVE-2017-5336, https://ubuntu.com/security/CVE-2017-5337