Description
Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gnutls28 | 3.3.8-7 | — |
| Debian 13 | gnutls28 | 3.3.8-7 | — |
| Debian 12 | gnutls28 | 3.3.8-7 | — |
References
- FEDORA-2015-5131 vendor-advisory
- [oss-security] 20150416 Re: double-free in gnutls (CRL distribution points parsing) mailing-list
- USN-2727-1 vendor-advisory
- http://www.gnutls.org/security.html#GNUTLS-SA-2015-4
- 74188 vdb-entry
- https://gitlab.com/gnutls/gnutls/commit/d6972be33264ecc49a86cd0958209cd7363af1e9
- [oss-security] 20150415 double-free in gnutls (CRL distribution points parsing) mailing-list
- GLSA-201506-03 vendor-advisory
- 1033774 vdb-entry
- https://gitlab.com/gnutls/gnutls/commit/053ae65403216acdb0a4e78b25ad66ee9f444f02