Input validation error in GnuTLS - CVE-2015-3308

Vulnerability identifier: #VU32426

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-3308

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.

GnuTLS
Gentoo Linux
Fedora
gnutls (Alpine package)
mingw-p11-kit
mingw-gnutls
gnutls
mingw-libtasn1

Update to version 3.3.14.

GnuTLS - update to 3.3.14
gnutls (Alpine package) - update to 3.3.14-r0
mingw-p11-kit - update to 0.20.7-1.el7
mingw-gnutls - update to 3.3.14-1.el7
gnutls - update to 3.3.14-1.fc22
mingw-libtasn1 - update to 4.4-1.el7

• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155101.html
• http://www.gnutls.org/security.html#GNUTLS-SA-2015-4
• http://www.openwall.com/lists/oss-security/2015/04/15/6
• http://www.openwall.com/lists/oss-security/2015/04/16/6
• http://www.securityfocus.com/bid/74188
• http://www.securitytracker.com/id/1033774
• http://www.ubuntu.com/usn/USN-2727-1
• https://gitlab.com/gnutls/gnutls/commit/053ae65403216acdb0a4e78b25ad66ee9f444f02
• https://gitlab.com/gnutls/gnutls/commit/d6972be33264ecc49a86cd0958209cd7363af1e9
• https://security.gentoo.org/glsa/201506-03

• Input validation error in GnuTLS
• Input validation error in gnutls (Alpine package)
• Gentoo update for GnuTLS
• Fedora 22 update for gnutls
• Fedora EPEL 7 update for mingw-gnutls, mingw-libtasn1, mingw-p11-kit