What is CVE-2011-4128?

CVE-2011-4128 is a vulnerability in GNU Gnutls, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2011-12-08.

Is CVE-2011-4128 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in GNU Gnutls

CVE-2011-4128

Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service (application crash) via a large SessionTicket.

Vulnerability class: Buffer Overflow

EPSS: 0.023 (81.5th percentile) — read the EPSS interpretation.

Affected products

Gnu Gnutls — versions 2.12.0, 2.12.1, 2.12.2
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)

Frequently asked questions

What is CVE-2011-4128?: CVE-2011-4128 is a vulnerability in GNU Gnutls, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2011-12-08.
Is CVE-2011-4128 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.