Summary
Joonas Kuorilehto discovered that GnuTLS incorrectly handled Server Hello
messages. A malicious remote server or a machine-in-the-middle could use this
issue to cause GnuTLS to crash, resulting in a denial of service, or
possibly execute arbitrary code.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | gnutls26 | 2.12.23-12ubuntu2.1 |
Vulnerabilities 1
-
Unscored —
Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.1…
References
-
report
https://ubuntu.com/security/CVE-2014-3466