Vulnerability in Gnu Gnutls

CVE-2009-1415

lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.

EPSS: 0.079 (94.1th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

References

  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
  • cve@mitre.org (mailing-list, x_refsource_MLIST, Broken Link)
  • cve@mitre.org (mailing-list, x_refsource_MLIST, Patch, Broken Link)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
  • cve@mitre.org (x_refsource_CONFIRM, Exploit, Broken Link)
  • cve@mitre.org (vdb-entry, Not Applicable, x_refsource_XF)
  • cve@mitre.org (vdb-entry, Broken Link, x_refsource_VUPEN)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
  • cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)