This update for gnutls fixes the following issues: - Malformed asn1 definitions could cause a segmentation fault in the asn1 definition parser (bsc#961491). - CVE-2016-8610: Remote denial of service in SSL alert handling (bsc#1005879). - CVE-2017-5335: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). - CVE-2017-5336: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). - CVE-2017-5337: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4:
#1005879 #1018832 #961491
Cross- CVE-2016-8610 CVE-2017-5335 CVE-2017-5336
CVE-2017-5337
Affected Products:
SUSE Linux Enterprise Software Development Kit 11-SP4
SUSE Linux Enterprise Server 11-SP4
SUSE Linux Enterprise High Availability Extension 11-SP4
SUSE Linux Enterprise Debuginfo 11-SP4
https://www.suse.com/security/cve/CVE-2016-8610.html
https://www.suse.com/security/cve/CVE-2017-5335.html
https://www.suse.com/security/cve/CVE-2017-5336.html
https://www.suse.com/security/cve/CVE-2017-5337.html
https://bugzilla.suse.com/1005879
https://bugzilla.suse.com/1018832
https://bugzilla.suse.com/961491
Get the latest Linux and open source security news straight to your inbox.