DSA-5203: -1 gnutls28 -- security update
gnutls28 - security update
Other sources
Jaak Ristioja discovered a double-free vulnerability in GnuTLS, a library implementing the TLS and SSL protocols, during verification of pkcs7 signatures. A remote attacker can take advantage of this flaw to cause an application using the GnuTLS library to crash (denial of service), or potentially, to execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gnutls28to a version that resolves this vulnerability.Patch DSA-5203-1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications that use the GnuTLS library and perform verification of PKCS#7 signatures are exposed to the vulnerable code path.
What does an attacker need to do to exploit the flaw?
A remote attacker would need to trigger PKCS#7 signature verification in an application using GnuTLS. Successful exploitation can crash the application and may potentially allow arbitrary code execution.