CVE-2015-6251: Use After Free
First published: Mon Aug 10 2015(Updated: )
A use-after-free flaw was found in GnuTLS's _gnutls_x509_dn_to_string() function. A remote attacker could create a specially crafted certificate with very long DistinguishedName (DN) entries that, when processed by an application compiled against GnuTLS, could cause that application to crash. This issue was fixed in upstream versions 3.4.4 and 3.3.17 of GnuTLS: <a href="https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007707.html">https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007707.html</a> <a href="https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007708.html">https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007708.html</a> The following patch fixes this issue: <a href="https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12">https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12</a> The affected function, _gnutls_x509_dn_to_string(), was first introduced in version 3.1.10 via commit: <a href="https://gitlab.com/gnutls/gnutls/commit/6be35136333b5d6289f23209cf896e741462909a">https://gitlab.com/gnutls/gnutls/commit/6be35136333b5d6289f23209cf896e741462909a</a> The gnutls packages in Red Hat Enterprise Linux 6 and earlier include GnuTLS versions 2.x or 1.x and are therefore not affected by this issue. External References: <a href="http://www.gnutls.org/security.html#GNUTLS-SA-2015-3">http://www.gnutls.org/security.html#GNUTLS-SA-2015-3</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/gnutls | <3.4.4 | 3.4.4 |
| redhat/gnutls | <3.3.17 | 3.3.17 |
| GNU GnuTLS | =3.3.0 | |
| GNU GnuTLS | =3.3.0-pre0 | |
| GNU GnuTLS | =3.3.1 | |
| GNU GnuTLS | =3.3.2 | |
| GNU GnuTLS | =3.3.3 | |
| GNU GnuTLS | =3.3.4 | |
| GNU GnuTLS | =3.3.5 | |
| GNU GnuTLS | =3.3.6 | |
| GNU GnuTLS | =3.3.7 | |
| GNU GnuTLS | =3.3.8 | |
| GNU GnuTLS | =3.3.9 | |
| GNU GnuTLS | =3.3.10 | |
| GNU GnuTLS | =3.3.11 | |
| GNU GnuTLS | =3.3.12 | |
| GNU GnuTLS | =3.3.13 | |
| GNU GnuTLS | =3.3.14 | |
| GNU GnuTLS | =3.3.15 | |
| GNU GnuTLS | =3.3.16 | |
| GNU GnuTLS | =3.4.0 | |
| GNU GnuTLS | =3.4.1 | |
| GNU GnuTLS | =3.4.2 | |
| GNU GnuTLS | =3.4.3 | |
| Debian Debian Linux | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165286.html
- http://lists.opensuse.org/opensuse-updates/2015-09/msg00001.html
- http://www.debian.org/security/2015/dsa-3334
- http://www.gnutls.org/security.html#GNUTLS-SA-2015-3
- http://www.openwall.com/lists/oss-security/2015/08/10/1
- http://www.openwall.com/lists/oss-security/2015/08/17/6
- http://www.securityfocus.com/bid/76267
- http://www.securitytracker.com/id/1033226
- https://bugzilla.redhat.com/show_bug.cgi?id=1251902
- https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12
- https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007707.html
- https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007708.html
- https://gitlab.com/gnutls/gnutls/commit/6be35136333b5d6289f23209cf896e741462909a
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1251905
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1251904
- http://seclists.org/oss-sec/2015/q3/308
- agent/references
- agent/type
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/weakness
- agent/severity
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-6251
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- vendor/gnu
- canonical/gnu gnutls
- version/gnu gnutls/3.3.0
- version/gnu gnutls/3.3.0-pre0
- version/gnu gnutls/3.3.1
- version/gnu gnutls/3.3.2
- version/gnu gnutls/3.3.3
- version/gnu gnutls/3.3.4
- version/gnu gnutls/3.3.5
- version/gnu gnutls/3.3.6
- version/gnu gnutls/3.3.7
- version/gnu gnutls/3.3.8
- version/gnu gnutls/3.3.9
- version/gnu gnutls/3.3.10
- version/gnu gnutls/3.3.11
- version/gnu gnutls/3.3.12
- version/gnu gnutls/3.3.13
- version/gnu gnutls/3.3.14
- version/gnu gnutls/3.3.15
- version/gnu gnutls/3.3.16
- version/gnu gnutls/3.4.0
- version/gnu gnutls/3.4.1
- version/gnu gnutls/3.4.2
- version/gnu gnutls/3.4.3
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- package-manager/redhat