CVE-2015-3308

GnuTLS < 3.3.14 - Use-After-Free in CRL Distribution Point Parsing

Title source: llm
STIX 2.1

Description

Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.

References (10)

Core 10
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155101.html
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/04/16/6
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2727-1
Various Sources x_refsource_confirm
http://www.gnutls.org/security.html#GNUTLS-SA-2015-4
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/74188
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/04/15/6
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201506-03
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1033774

Scores

EPSS 0.0139
EPSS Percentile 80.6%

Details

Status published
Products (2)
canonical/ubuntu_linux 15.04
gnu/gnutls < 3.3.13
Published Sep 02, 2015
Tracked Since Feb 18, 2026