Fluid Attacks Database

Description

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	gnutls28	>=0 <3.2.15-1	3.2.15-1
debian 11	gnutls28	>=0 <3.2.15-1	3.2.15-1
debian 12	gnutls28	>=0 <3.2.15-1	3.2.15-1
debian 13	gnutls28	>=0 <3.2.15-1	3.2.15-1
rpm rhel7	gnutls	<0:3.1.18-9.el7_0	0:3.1.18-9.el7_0
rpm rhel5	gnutls	<0:1.4.1-16.el5_10	0:1.4.1-16.el5_10
rpm rhel6	gnutls	<0:2.8.5-14.el6_5	0:2.8.5-14.el6_5
rpm rhel6	mingw32-gnutls	-	-

Aliases

1. CVE-2014-34662. NVD-2014-34663. OSV-DEBIAN-2014-34664. OSV-2014-34665. SECURITY-TRACKER-CVE-2014-3466

References

1. https://github.com/azet/CVE-2014-3466_PoC

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.