CVE-2014-8564
Fixed in a distro release EPSS 3%
The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.
Products: gnutls, redhat enterprise_linux_desktop, redhat enterprise_linux_hpc_node, redhat enterprise_linux_server, redhat enterprise_linux_workstation, opensuse, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | gnutls28 | 3.3.8-4 |
| Debian 13 | gnutls28 | 3.3.8-4 |
| Debian 14 | gnutls28 | 3.3.8-4 |
| Red Hat Enterprise Linux 7 | gnutls | 0:3.1.18-10.el7_0 |
| Red Hat Enterprise Linux 7 | gnutls-c++ | 0:3.1.18-10.el7_0 |
| Red Hat Enterprise Linux 7 | gnutls-dane | 0:3.1.18-10.el7_0 |
| Red Hat Enterprise Linux 7 | gnutls-debuginfo | 0:3.1.18-10.el7_0 |
| Red Hat Enterprise Linux 7 | gnutls-devel | 0:3.1.18-10.el7_0 |
| Red Hat Enterprise Linux 7 | gnutls-utils | 0:3.1.18-10.el7_0 |
| openSUSE Tumbleweed | gnutls | 3.4.15-1.1 |