Summary
It was discovered that GnuTLS incorrectly handled exporting Subject
Alternative Name (SAN) entries containing an otherName. A remote attacker
could use this issue to cause GnuTLS to crash, resulting in a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2025-32988)
It was discovered that the GnuTLS certtool utility incorrectly handled
parsing certain template files. An attacker could use this issue to cause
GnuTLS to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2025-32990)
Stefan Bühler discovered that GnuTLS incorrectly handled parsing certain
template files. An attacker could possibly use this issue to cause GnuTLS
to crash, resulting in a denial of service. This issue only affected
Ubuntu 20.04 LTS. (CVE-2025-6395)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | gnutls28 | 3.4.10-4ubuntu1.9+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | gnutls28 | 3.5.18-1ubuntu1.6+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | gnutls28 | 3.6.13-2ubuntu1.12+esm1 |
Vulnerabilities 3
-
Medium 6.5
Gnutls: vulnerability in gnutls othername san export
A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call as…
-
Medium 6.5
Gnutls: vulnerability in gnutls certtool template parsing
A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write,…
-
Medium 6.5
Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()
A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().