CVE-2014-3466
Fixed in a distro release EPSS 11%
Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.
Products: gnutls
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | gnutls28 | 3.2.15-1 |
| Debian 13 | gnutls28 | 3.2.15-1 |
| Debian 14 | gnutls28 | 3.2.15-1 |
| Debian 6.0 | gnutls26 | 2.8.6-1+squeeze4 |
| Debian 7 | gnutls26 | 2.12.20-8+deb7u2 |
| Red Hat Enterprise Linux 5 | gnutls | 0:1.4.1-16.el5_10 |
| Red Hat Enterprise Linux 5 | gnutls-debuginfo | 0:1.4.1-16.el5_10 |
| Red Hat Enterprise Linux 5 | gnutls-devel | 0:1.4.1-16.el5_10 |
| Red Hat Enterprise Linux 5 | gnutls-utils | 0:1.4.1-16.el5_10 |
| Red Hat Enterprise Linux 6 | gnutls | 0:2.8.5-14.el6_5 |
| Red Hat Enterprise Linux 6 | gnutls-debuginfo | 0:2.8.5-14.el6_5 |
| Red Hat Enterprise Linux 6 | gnutls-devel | 0:2.8.5-14.el6_5 |
| Red Hat Enterprise Linux 6 | gnutls-guile | 0:2.8.5-14.el6_5 |
| Red Hat Enterprise Linux 6 | gnutls-utils | 0:2.8.5-14.el6_5 |
| Red Hat Enterprise Linux 6 | rhev-hypervisor6 | 0:6.5-20140624.0.el6ev |
| Red Hat Enterprise Linux 7 | gnutls | 0:3.1.18-9.el7_0 |
| Red Hat Enterprise Linux 7 | gnutls-c++ | 0:3.1.18-9.el7_0 |
| Red Hat Enterprise Linux 7 | gnutls-dane | 0:3.1.18-9.el7_0 |
| Red Hat Enterprise Linux 7 | gnutls-debuginfo | 0:3.1.18-9.el7_0 |
| Red Hat Enterprise Linux 7 | gnutls-devel | 0:3.1.18-9.el7_0 |
| Red Hat Enterprise Linux 7 | gnutls-utils | 0:3.1.18-9.el7_0 |
| Ubuntu 14.04 LTS | gnutls26 | 2.12.23-12ubuntu2.1 |
| Ubuntu 14.04 LTS | gnutls28 | 3.2.11-2ubuntu1.1 |
| openSUSE Tumbleweed | gnutls | 3.4.15-1.1 |