CVE-2012-1663: Double Free
Published Mar 13, 2012
·Updated
Double free vulnerability in libgnutls in GnuTLS before 3.0.14 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted certificate list.
Affected Software
165 affected components
GNU GnuTLS<=3.0.13
GNU GnuTLS=1.0.16
GNU GnuTLS=1.0.17
GNU GnuTLS=1.0.18
GNU GnuTLS=1.0.19
GNU GnuTLS=1.0.20
GNU GnuTLS=1.0.21
GNU GnuTLS=1.0.22
GNU GnuTLS=1.0.23
GNU GnuTLS=1.0.24
GNU GnuTLS=1.0.25
GNU GnuTLS=1.1.13
GNU GnuTLS=1.1.14
GNU GnuTLS=1.1.15
GNU GnuTLS=1.1.16
GNU GnuTLS=1.1.17
GNU GnuTLS=1.1.18
GNU GnuTLS=1.1.19
GNU GnuTLS=1.1.20
GNU GnuTLS=1.1.21
GNU GnuTLS=1.1.22
GNU GnuTLS=1.1.23
GNU GnuTLS=1.2.0
GNU GnuTLS=1.2.1
GNU GnuTLS=1.2.2
GNU GnuTLS=1.2.3
GNU GnuTLS=1.2.4
GNU GnuTLS=1.2.5
GNU GnuTLS=1.2.6
GNU GnuTLS=1.2.7
GNU GnuTLS=1.2.8
GNU GnuTLS=1.2.8.1a1
GNU GnuTLS=1.2.9
GNU GnuTLS=1.2.10
GNU GnuTLS=1.2.11
GNU GnuTLS=1.3.0
GNU GnuTLS=1.3.1
GNU GnuTLS=1.3.2
GNU GnuTLS=1.3.3
GNU GnuTLS=1.3.4
GNU GnuTLS=1.3.5
GNU GnuTLS=1.4.0
GNU GnuTLS=1.4.1
GNU GnuTLS=1.4.2
GNU GnuTLS=1.4.3
GNU GnuTLS=1.4.4
GNU GnuTLS=1.4.5
GNU GnuTLS=1.5.0
GNU GnuTLS=1.5.1
GNU GnuTLS=1.5.2
GNU GnuTLS=1.5.3
GNU GnuTLS=1.5.4
GNU GnuTLS=1.5.5
GNU GnuTLS=1.6.0
GNU GnuTLS=1.6.1
GNU GnuTLS=1.6.2
GNU GnuTLS=1.6.3
GNU GnuTLS=1.7.0
GNU GnuTLS=1.7.1
GNU GnuTLS=1.7.2
GNU GnuTLS=1.7.3
GNU GnuTLS=1.7.4
GNU GnuTLS=1.7.5
GNU GnuTLS=1.7.6
GNU GnuTLS=1.7.7
GNU GnuTLS=1.7.8
GNU GnuTLS=1.7.9
GNU GnuTLS=1.7.10
GNU GnuTLS=1.7.11
GNU GnuTLS=1.7.12
GNU GnuTLS=1.7.13
GNU GnuTLS=1.7.14
GNU GnuTLS=1.7.15
GNU GnuTLS=1.7.16
GNU GnuTLS=1.7.17
GNU GnuTLS=1.7.18
GNU GnuTLS=1.7.19
GNU GnuTLS=2.0.0
GNU GnuTLS=2.0.1
GNU GnuTLS=2.0.2
GNU GnuTLS=2.0.3
GNU GnuTLS=2.0.4
GNU GnuTLS=2.1.0
GNU GnuTLS=2.1.1
GNU GnuTLS=2.1.2
GNU GnuTLS=2.1.3
GNU GnuTLS=2.1.4
GNU GnuTLS=2.1.5
GNU GnuTLS=2.1.6
GNU GnuTLS=2.1.7
GNU GnuTLS=2.1.8
GNU GnuTLS=2.2.0
GNU GnuTLS=2.2.1
GNU GnuTLS=2.2.2
GNU GnuTLS=2.2.3
GNU GnuTLS=2.2.4
GNU GnuTLS=2.2.5
GNU GnuTLS=2.3.0
GNU GnuTLS=2.3.1
GNU GnuTLS=2.3.2
GNU GnuTLS=2.3.3
GNU GnuTLS=2.3.4
GNU GnuTLS=2.3.5
GNU GnuTLS=2.3.6
GNU GnuTLS=2.3.7
GNU GnuTLS=2.3.8
GNU GnuTLS=2.3.9
GNU GnuTLS=2.3.10
GNU GnuTLS=2.3.11
GNU GnuTLS=2.4.0
GNU GnuTLS=2.4.1
GNU GnuTLS=2.4.2
GNU GnuTLS=2.4.3
GNU GnuTLS=2.5.0
GNU GnuTLS=2.6.0
GNU GnuTLS=2.6.1
GNU GnuTLS=2.6.2
GNU GnuTLS=2.6.3
GNU GnuTLS=2.6.4
GNU GnuTLS=2.6.5
GNU GnuTLS=2.6.6
GNU GnuTLS=2.7.4
GNU GnuTLS=2.8.0
GNU GnuTLS=2.8.1
GNU GnuTLS=2.8.2
GNU GnuTLS=2.8.3
GNU GnuTLS=2.8.4
GNU GnuTLS=2.8.5
GNU GnuTLS=2.8.6
GNU GnuTLS=2.10.0
GNU GnuTLS=2.10.1
GNU GnuTLS=2.10.2
GNU GnuTLS=2.10.3
GNU GnuTLS=2.10.4
GNU GnuTLS=2.10.5
GNU GnuTLS=2.12.0
GNU GnuTLS=2.12.1
GNU GnuTLS=2.12.2
GNU GnuTLS=2.12.3
GNU GnuTLS=2.12.4
GNU GnuTLS=2.12.5
GNU GnuTLS=2.12.6
GNU GnuTLS=2.12.6.1
GNU GnuTLS=2.12.7
GNU GnuTLS=2.12.8
GNU GnuTLS=2.12.9
GNU GnuTLS=2.12.10
GNU GnuTLS=2.12.11
GNU GnuTLS=2.12.12
GNU GnuTLS=2.12.13
GNU GnuTLS=2.12.14
GNU GnuTLS=3.0
GNU GnuTLS=3.0.0
GNU GnuTLS=3.0.1
GNU GnuTLS=3.0.2
GNU GnuTLS=3.0.3
GNU GnuTLS=3.0.4
GNU GnuTLS=3.0.5
GNU GnuTLS=3.0.6
GNU GnuTLS=3.0.7
GNU GnuTLS=3.0.8
GNU GnuTLS=3.0.9
GNU GnuTLS=3.0.10
GNU GnuTLS=3.0.11
GNU GnuTLS=3.0.12
Remediation
Event History
Mar 13, 2012
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-1663?
CVE-2012-1663 is classified as a denial of service vulnerability that can crash the application.
2
How do I fix CVE-2012-1663?
To fix CVE-2012-1663, upgrade GnuTLS to version 3.0.14 or later.
3
What types of systems are affected by CVE-2012-1663?
CVE-2012-1663 affects all versions of GnuTLS prior to 3.0.14, including versions 1.0.16 to 2.12.13.
4
Can CVE-2012-1663 lead to any other impacts besides a crash?
While the primary impact of CVE-2012-1663 is a denial of service, there may be unspecified other impacts due to application behavior.
5
Who can exploit CVE-2012-1663 and how?
Remote attackers can exploit CVE-2012-1663 by sending a crafted certificate list to applications using vulnerable versions of GnuTLS.