CVE-2014-8564

GnuTLS 3.x < 3.1.28, 3.2.x < 3.2.20, 3.3.x < 3.3.10 - Denial of Service via ECC Certificate Processing

Title source: llm
STIX 2.1

Description

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

References (7)

Core 7
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59991
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1846.html
Patch, Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2403-1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62294
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1161443
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62284
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-11/msg00084.html

Scores

EPSS 0.0069
EPSS Percentile 72.1%

Details

CWE
CWE-310
Status published
Products (50)
canonical/ubuntu_linux 14.10
gnu/gnutls 3.0
gnu/gnutls 3.0.0
gnu/gnutls 3.0.1
gnu/gnutls 3.0.2
gnu/gnutls 3.0.3
gnu/gnutls 3.0.4
gnu/gnutls 3.0.5
gnu/gnutls 3.0.6
gnu/gnutls 3.0.7
... and 40 more
Published Nov 13, 2014
Tracked Since Feb 18, 2026