PT-2015-1926 · Gnu+1 · Gnutls+1

Kurt Roeckx · Published 2015-08-12 · Updated 2024-06-15 · CVE-2015-6251

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 3.3.17 GnuTLS versions 3.4.x prior to 3.4.4

Description The issue is related to a double free vulnerability that can be exploited by remote attackers to cause a denial of service. This can be achieved by providing a long DistinguishedName (DN) entry in a certificate. The vulnerability is associated with an error in memory management, specifically a double free error, which can lead to a denial of service.

Recommendations For GnuTLS versions prior to 3.3.17, update to version 3.3.17 or later. For GnuTLS versions 3.4.x prior to 3.4.4, update to version 3.4.4 or later.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

BDU:2015-11272

CVE-2015-6251

DSA-3334-1

MGASA-2015-0322

OPENSUSE-SU-2024:10105-1

SUSE-SU-2015:1518-1

USN-2727-1

Affected Products

Gnutls

Suse

References · 46

• https://osv.dev/vulnerability/MGASA-2015-0322 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10105-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-6251 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0322.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-6251 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-6251 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1518-1 · Vendor Advisory
• http://debian.org/security/2015/dsa-3334 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2727-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-6251 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-6251 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11272 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6251 · Security Note
• http://gnutls.org/security.html#GNUTLS-SA-2015-3 · Vendor Advisory
• https://debian.org/security/2015/dsa-3334 · Vendor Advisory