PT-2017-17779 · Gnu+5 · Gnutls+5

Publicado 2017-06-09 · Atualizado 2018-01-05 · CVE-2017-7507

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GnuTLS versions 3.5.12 and earlier

Description The issue is related to a NULL pointer dereference that occurs while decoding a status response TLS extension with valid contents. This could potentially cause the GnuTLS server application to crash.

Recommendations For versions 3.5.12 and earlier, update to a version later than 3.5.12 to resolve the issue.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2017-1724

CESA-2017_2292

CVE-2017-7507

DSA-3884-1

MGASA-2017-0212

RHSA-2017:2292

RHSA-2017_2292

SUSE-SU-2017:1838-1

SUSE-SU-2017_1838-1

USN-3318-1

Produtos afetados

Alt Linux

Centos

Gnutls

Red Hat

Suse

Ubuntu

Referências · 60

• https://osv.dev/vulnerability/DSA-3884-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-7507 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-7507 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=20417 · Nota
• https://suse.com/security/cve/CVE-2017-7507.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5337 · Nota de Segurança
• https://bugzilla.suse.com/1038337 · Nota
• https://osv.dev/vulnerability/USN-3318-1 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2017-5334 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2017-August/023758.html · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2017-August/004178.html · Nota
• https://ubuntu.com/security/CVE-2017-7869 · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-cr-announce/2017-August/030448.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5335 · Nota de Segurança
• https://gnutls.org/security.html#GNUTLS-SA-2017-4 · Aviso do Fabricante