Alerts This Week
Warning Icon 1 697
Alerts This Week
Warning Icon 1 697

SUSE: 2017:0304-1 Important: Gnutls DoS and Overflow Issues

suse
Calendar Grey January 27, 2017
Dist Suse Esm H88
SUSE enhances gnutls to fix multiple critical vulnerabilities that could lead to service disruptions and additional risks.
An update that fixes four vulnerabilities is now available

Summary

This update for gnutls fixes the following issues: - Malformed asn1 definitions could cause a segmentation fault in the asn1 definition parser (bsc#961491). - CVE-2016-8610: Remote denial of service in SSL alert handling (bsc#1005879). - CVE-2017-5335: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). - CVE-2017-5336: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). - CVE-2017-5337: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4:

References

#1005879 #1018832 #961491

Cross- CVE-2016-8610 CVE-2017-5335 CVE-2017-5336

CVE-2017-5337

Affected Products:

SUSE Linux Enterprise Software Development Kit 11-SP4

SUSE Linux Enterprise Server 11-SP4

SUSE Linux Enterprise High Availability Extension 11-SP4

SUSE Linux Enterprise Debuginfo 11-SP4

https://www.suse.com/security/cve/CVE-2016-8610.html

https://www.suse.com/security/cve/CVE-2017-5335.html

https://www.suse.com/security/cve/CVE-2017-5336.html

https://www.suse.com/security/cve/CVE-2017-5337.html

https://bugzilla.suse.com/1005879

https://bugzilla.suse.com/1018832

https://bugzilla.suse.com/961491

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2017:0304-1
Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here