Fluid Attacks Database

Description

gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	gnutls28	>=0 <3.0.17-2	3.0.17-2
debian 12	gnutls28	>=0 <3.0.17-2	3.0.17-2
debian 13	gnutls28	>=0 <3.0.17-2	3.0.17-2
debian 14	gnutls28	>=0 <3.0.17-2	3.0.17-2
rpm rhel5	gnutls	<0:1.4.1-7.el5_8.2	0:1.4.1-7.el5_8.2
rpm rhel6	gnutls	<0:2.8.5-4.el6_2.2	0:2.8.5-4.el6_2.2
rpm rhel6	mingw32-gnutls	-	-

Aliases

1. CVE-2012-15732. NVD-2012-15733. OSV-DEBIAN-2012-15734. OSV-2012-15735. SECURITY-TRACKER-CVE-2012-1573

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.