CVE-2013-2116: Input Validation
Published Jul 3, 2013
·Updated
The gnutlsciphertext2compressed function in lib/gnutlscipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169.
Affected Software
1 affected component
GNU GnuTLS=2.12.23
Event History
Jul 3, 2013
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-2116?
CVE-2013-2116 is classified as a denial of service vulnerability.
2
How do I fix CVE-2013-2116?
To fix CVE-2013-2116, upgrade to a later version of GnuTLS that has addressed this vulnerability.
3
What software versions are affected by CVE-2013-2116?
GnuTLS version 2.12.23 is affected by CVE-2013-2116.
4
What type of attack is associated with CVE-2013-2116?
CVE-2013-2116 is associated with a remote denial of service attack through buffer over-read.
5
Is CVE-2013-2116 related to any other vulnerabilities?
Yes, CVE-2013-2116 is noted to potentially be due to an incorrect fix for CVE-2013-0169.