PT-2017-16439 · Gnu+3 · Gnutls+3

Nikos Mavrogiannopoulos · Published 2017-01-11 · Updated 2018-10-30 · CVE-2017-5334

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 3.3.26 GnuTLS versions 3.5.x prior to 3.5.8

Description A double free vulnerability exists in the gnutls x509 ext import proxy function, allowing remote attackers to have an unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.

Recommendations For GnuTLS versions prior to 3.3.26, update to version 3.3.26 or later. For GnuTLS versions 3.5.x prior to 3.5.8, update to version 3.5.8 or later.

Exploit

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

CESA-2017_2292

CVE-2017-5334

MGASA-2017-0053

RHSA-2017:2292

RHSA-2017_2292

USN-3183-1

Affected Products

Centos

Gnutls

Red Hat

Ubuntu

References · 52

• 🔥 https://github.com/cujanovic/CVE-2016-8610-PoC · Exploit
• https://ubuntu.com/security/CVE-2016-8610 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5337 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5335 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-5334 · Vendor Advisory
• https://gnutls.org/security.html#GNUTLS-SA-2017-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5334 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:2292 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5336 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5337 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7507 · Security Note
• https://bdu.fstec.ru/vul/2017-01458 · Security Note
• https://ubuntu.com/security/notices/USN-3183-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01459 · Security Note