CVE-2009-1415

Gnutls < 2.6.6 - Denial of Service

Title source: rule

Description

lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Miroslav Kratochvil · cdoslinux

https://www.exploit-db.com/exploits/32964

View Code ZIP pw:eip

References (13)

[Broken Link, Patch] http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515

[Broken Link] http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3502

[Broken Link, Vendor Advisory] http://secunia.com/advisories/34842

[Broken Link] http://secunia.com/advisories/35211

[Third Party Advisory] http://security.gentoo.org/glsa/glsa-200905-04.xml

[Broken Link, Exploit] http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3488

[Broken Link] http://www.mandriva.com/security/advisories?name=MDVSA-2009:116

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/34783

[Broken Link, Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1022157

[Broken Link] http://www.vupen.com/english/advisories/2009/1218

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/50257

[Not Applicable] https://exchange.xforce.ibmcloud.com/vulnerabilities/50260

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/50445

Scores

EPSS 0.1776

EPSS Percentile 95.1%

Details

CWE

CWE-824

Status published

Products (1)

gnu/gnutls < 2.6.6

Published Apr 30, 2009

Tracked Since Feb 18, 2026