Red Hat Security Advisory

RHSA-2014:0594

gnutls security update

Released 2014-06-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) gnutls-1.4.1-16.el5_10, gnutls-1.4.1-16.el5_10.i386, gnutls-1.4.1-16.el5_10.ia64 +9
Red Hat Enterprise Linux Desktop (v. 5 client) gnutls-1.4.1-16.el5_10, gnutls-1.4.1-16.el5_10.i386, gnutls-utils-1.4.1-16.el5_10 +1
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) gnutls-1.4.1-16.el5_10, gnutls-devel-1.4.1-16.el5_10, gnutls-devel-1.4.1-16.el5_10.i386

Fixes 4 records

TI-2014-02793 CVE-2014-3466 · GHSA-cc2g-hj2r-x228

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS…

MEDIUM 43

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or p…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.11221 Published 2014-06-03 Partial fix CWE-119

TI-2014-02795 CVE-2014-3468 · GHSA-qg3j-x87h-jwjm

The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an…

LOW 39

The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03789 Published 2014-06-05 Partial fix CWE-131

TI-2014-02794 CVE-2014-3467 · GHSA-pfh9-rfxw-j6x2

Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as…

LOW 33

Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.068 Published 2014-06-05 Partial fix

TI-2014-02796 CVE-2014-3469 · GHSA-52vj-cjhg-wpwv

The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6…

LOW 29

The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03817 Published 2014-06-05 Partial fix CWE-476