Slackware Linux update for gnutls
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2011-4128 CVE-2012-1569 CVE-2012-1573 CVE-2013-1619 CVE-2013-2116 |
| CWE-ID | CWE-119 CWE-20 CWE-310 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Slackware Linux Operating systems & Components / Operating system |
| Vendor | Slackware |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Buffer overflow
EUVDB-ID: #VU32707
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2011-4128
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform service disruption.
Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service (application crash) via a large SessionTicket.
MitigationUpdate the affected package gnutls.
Vulnerable software versionsSlackware Linux: 13.0 - 13.37
CPE2.3- cpe:2.3:o:slackware:slackware_linux:13.0:*:*:*:*:*:*:*
- cpe:2.3:o:slackware:slackware_linux:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:slackware:slackware_linux:13.37:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU44184
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2012-1569
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform service disruption.
The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
MitigationUpdate the affected package gnutls.
Vulnerable software versionsSlackware Linux: 13.0 - 13.37
CPE2.3- cpe:2.3:o:slackware:slackware_linux:13.0:*:*:*:*:*:*:*
- cpe:2.3:o:slackware:slackware_linux:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:slackware:slackware_linux:13.37:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Cryptographic issues
EUVDB-ID: #VU32801
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2012-1573
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform service disruption.
gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.
MitigationUpdate the affected package gnutls.
Vulnerable software versionsSlackware Linux: 13.0 - 13.37
CPE2.3- cpe:2.3:o:slackware:slackware_linux:13.0:*:*:*:*:*:*:*
- cpe:2.3:o:slackware:slackware_linux:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:slackware:slackware_linux:13.37:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Cryptographic issues
EUVDB-ID: #VU32712
Risk: Medium
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2013-1619
CWE-ID:
CWE-310 - Cryptographic Issues
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
MitigationUpdate the affected package gnutls.
Vulnerable software versionsSlackware Linux: 13.0 - 13.37
CPE2.3- cpe:2.3:o:slackware:slackware_linux:13.0:*:*:*:*:*:*:*
- cpe:2.3:o:slackware:slackware_linux:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:slackware:slackware_linux:13.37:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Input validation error
EUVDB-ID: #VU33306
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2013-2116
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (buffer over-read and crash) via a crafted padding length.
MitigationUpdate the affected package gnutls.
Vulnerable software versionsSlackware Linux: 13.0 - 13.37
CPE2.3- cpe:2.3:o:slackware:slackware_linux:13.0:*:*:*:*:*:*:*
- cpe:2.3:o:slackware:slackware_linux:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:slackware:slackware_linux:13.37:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
