CVE-2017-7869
Fixed in a distro release EPSS 3%
GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.
Products: gnutls
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | gnutls28 | 3.5.8-4 |
| Debian 13 | gnutls28 | 3.5.8-4 |
| Debian 14 | gnutls28 | 3.5.8-4 |
| Red Hat Enterprise Linux 7 | gnutls | 0:3.3.26-9.el7 |
| Red Hat Enterprise Linux 7 | gnutls-c++ | 0:3.3.26-9.el7 |
| Red Hat Enterprise Linux 7 | gnutls-dane | 0:3.3.26-9.el7 |
| Red Hat Enterprise Linux 7 | gnutls-debuginfo | 0:3.3.26-9.el7 |
| Red Hat Enterprise Linux 7 | gnutls-devel | 0:3.3.26-9.el7 |
| Red Hat Enterprise Linux 7 | gnutls-utils | 0:3.3.26-9.el7 |
| SUSE Linux Enterprise Desktop 12 SP2 | gnutls | 3.2.15-18.3.1 |
| SUSE Linux Enterprise High Availability Extension 11 SP4 | gnutls | 2.4.1-24.39.70.1 |
| SUSE Linux Enterprise Server 11 SP4 | gnutls | 2.4.1-24.39.70.1 |
| SUSE Linux Enterprise Server 12 SP2 | gnutls | 3.2.15-18.3.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | gnutls | 3.2.15-18.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | gnutls | 2.4.1-24.39.70.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | gnutls | 3.2.15-18.3.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | gnutls | 2.4.1-24.39.70.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | gnutls | 3.2.15-18.3.1 |
| Ubuntu 14.04 LTS | gnutls26 | 2.12.23-12ubuntu2.8 |
| Ubuntu 16.04 LTS | gnutls28 | 3.4.10-4ubuntu1.3 |
| openSUSE Tumbleweed | gnutls | 3.7.2-1.2 |