Alerts This Week
Warning Icon 1 485
Alerts This Week
Warning Icon 1 485

SUSE: gnutls Important Buffer Overflow Patch 2025:20665-1 CVE-2025-32988

suse
Calendar Grey September 10, 2025
Dist Suse Esm H88
Critical vulnerabilities in gnutls prompt urgent security update for SUSE Micro. It is advised that affected systems apply the patch without delay.
* bsc#1246232 * bsc#1246233 * bsc#1246267 * bsc#1246299

Summary

## This update for gnutls fixes the following issues: * CVE-2025-32988: Fixed double-free due to incorrect ownership handling in the export logic of SAN entries containing an otherName (bsc#1246232). * CVE-2025-32989: Fixed heap buffer overread when handling the CT SCT extension during X.509 certificate parsing (bsc#1246233). * CVE-2025-32990: Fixed 1-byte heap buffer overflow when parsing templates with certtool (bsc#1246267). * CVE-2025-6395: Fixed NULL pointer dereference when 2nd Client Hello omits PSK (bsc#1246299). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.1 zypper in -t patch SUSE-SLE-Micro-6.1-243=1 ## Package List:

Topics%20covered

Topics Covered

security advisory buffer overflow SuSE important heap overflow gnutls

References

* bsc#1246232

* bsc#1246233

* bsc#1246267

* bsc#1246299

Cross-

* CVE-2025-32988

* CVE-2025-32989

* CVE-2025-32990

* CVE-2025-6395

CVSS scores:

* CVE-2025-32988 ( SUSE ): 9.2

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

* CVE-2025-32988 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2025-32988 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

* CVE-2025-32988 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

* CVE-2025-32989 ( SUSE ): 8.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2025-32989 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

* CVE-2025-32989 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

* CVE-2025-32990 ( SUSE ): 4.8

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2025:20665-1
Release Date: 2025-08-29T09:13:16Z
Rating: important

Topics%20covered

Topics Covered

security advisory buffer overflow SuSE important heap overflow gnutls

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here