Buffer overflow in GnuTLS - CVE-2008-1949
Published: May 21, 2008 / Updated: April 30, 2026
Vulnerability identifier: #VU128563
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2008-1949
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to memory corruption in the GnuTLS library when parsing input. A remote attacker can send specially crafted input to execute arbitrary code.
Affected software
GnuTLS
Ubuntu
libgnutls12 (Ubuntu package)
libgnutls13 (Ubuntu package)
Ubuntu
libgnutls12 (Ubuntu package)
libgnutls13 (Ubuntu package)
How to mitigate CVE-2008-1949
Install security update from vendor's website.
GnuTLS - update to 2.2.5
libgnutls12 (Ubuntu package) - update to 1.2.9-2ubuntu1.2
libgnutls13 (Ubuntu package) - addressed in versions 1.4.4-3ubuntu0.1, 1.6.3-1ubuntu0.1, 2.0.4-1ubuntu2.1
libgnutls12 (Ubuntu package) - update to 1.2.9-2ubuntu1.2
libgnutls13 (Ubuntu package) - addressed in versions 1.4.4-3ubuntu0.1, 1.6.3-1ubuntu0.1, 2.0.4-1ubuntu2.1