Red Hat Security Advisory: gnutls security, bug fix, and enhancement update

Fixed packages 20

Vulnerabilities 4

• Unscored —
  CVE-2016-8610 Public exploit EPSS 40%

  A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL prot…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu
  Nov 13, 2017
• Unscored —
  CVE-2017-5335

  The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote a…

  gnutls28 gnutls28 gnutls26 Debian Ubuntu
  Mar 24, 2017
• Unscored —
  CVE-2017-5336

  Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x …

  gnutls28 gnutls28 gnutls26 Debian Ubuntu
  Mar 24, 2017
• Unscored —
  CVE-2017-5337

  Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allo…

  gnutls28 gnutls28 gnutls26 Debian Ubuntu
  Mar 24, 2017

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Release_Notes/index.html
• article
  https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Technical_Notes/index.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1320982
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1321112
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1323215
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1326073
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1326389
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1326886
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1327656
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1328205
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1333521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1335924
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1337460
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1384743
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1411836
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1412235
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1412236
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1415682
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0574.json
• report
  https://access.redhat.com/security/cve/CVE-2016-8610
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-8610
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-8610
• article
  http://security.360.cn/cve/CVE-2016-8610
• report
  https://access.redhat.com/security/cve/CVE-2017-5335
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5335
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5335
• report
  https://access.redhat.com/security/cve/CVE-2017-5336
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5336
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5336
• report
  https://access.redhat.com/security/cve/CVE-2017-5337
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5337
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5337