CVE-2013-4466: Buffer Overflow
Published Nov 19, 2013
·Updated
Buffer overflow in the danequerytlsa function in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.
Affected Software
20 affected components
GNU GnuTLS=3.1.0
GNU GnuTLS=3.1.1
GNU GnuTLS=3.1.2
GNU GnuTLS=3.1.3
GNU GnuTLS=3.1.4
GNU GnuTLS=3.1.5
GNU GnuTLS=3.1.6
GNU GnuTLS=3.1.7
GNU GnuTLS=3.1.8
GNU GnuTLS=3.1.9
GNU GnuTLS=3.1.10
GNU GnuTLS=3.1.11
GNU GnuTLS=3.1.12
GNU GnuTLS=3.1.13
GNU GnuTLS=3.1.14
GNU GnuTLS=3.2.0
GNU GnuTLS=3.2.1
GNU GnuTLS=3.2.2
GNU GnuTLS=3.2.3
GNU GnuTLS=3.2.4
Remediation
Event History
Nov 19, 2013
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-4466?
CVE-2013-4466 has been classified as a denial of service vulnerability due to buffer overflow, impacting the stability of applications using GnuTLS.
2
How do I fix CVE-2013-4466?
To fix CVE-2013-4466, upgrade GnuTLS to version 3.1.15 or 3.2.5 or later.
3
What causes CVE-2013-4466?
CVE-2013-4466 occurs when remote servers respond with more than four DANE entries, leading to memory corruption.
4
Which versions of GnuTLS are affected by CVE-2013-4466?
CVE-2013-4466 affects GnuTLS versions 3.1.0 to 3.1.14 and 3.2.0 to 3.2.4.
5
Can CVE-2013-4466 lead to data loss?
CVE-2013-4466 primarily leads to denial of service rather than direct data loss.