Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2017/01/10/7 | mailing-list x_refsource_MLIST |
| https://access.redhat.com/errata/RHSA-2017:2292 | vendor-advisory x_refsource_REDHAT |
| http://www.securitytracker.com/id/1037576 | vdb-entry x_refsource_SECTRACK |
| http://www.openwall.com/lists/oss-security/2017/01/11/4 | mailing-list x_refsource_MLIST |
| https://gnutls.org/security.html#GNUTLS-SA-2017-1 | x_refsource_CONFIRM |
| http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html | vendor-advisory x_refsource_SUSE |
| http://www.securityfocus.com/bid/95370 | vdb-entry x_refsource_BID |
| https://security.gentoo.org/glsa/201702-04 | vendor-advisory x_refsource_GENTOO |
| https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b | x_refsource_CONFIRM |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2017/01/10/7 | mailing-list x_refsource_MLIST x_transferred |
| https://access.redhat.com/errata/RHSA-2017:2292 | vendor-advisory x_refsource_REDHAT x_transferred |
| http://www.securitytracker.com/id/1037576 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://www.openwall.com/lists/oss-security/2017/01/11/4 | mailing-list x_refsource_MLIST x_transferred |
| https://gnutls.org/security.html#GNUTLS-SA-2017-1 | x_refsource_CONFIRM x_transferred |
| http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html | vendor-advisory x_refsource_SUSE x_transferred |
| http://www.securityfocus.com/bid/95370 | vdb-entry x_refsource_BID x_transferred |
| https://security.gentoo.org/glsa/201702-04 | vendor-advisory x_refsource_GENTOO x_transferred |
| https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b | x_refsource_CONFIRM x_transferred |
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.0 | 9.8 | CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Primary | 2.0 | 7.5 | HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| Hyperlink | Source | Resource |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html | security@debian.org | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2017/01/10/7 | security@debian.org | Mailing List Patch Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2017/01/11/4 | security@debian.org | Mailing List Patch Third Party Advisory |
| http://www.securityfocus.com/bid/95370 | security@debian.org | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1037576 | security@debian.org | Third Party Advisory VDB Entry |
| https://access.redhat.com/errata/RHSA-2017:2292 | security@debian.org | N/A |
| https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b | security@debian.org | Issue Tracking Patch Third Party Advisory |
| https://gnutls.org/security.html#GNUTLS-SA-2017-1 | security@debian.org | Vendor Advisory |
| https://security.gentoo.org/glsa/201702-04 | security@debian.org | Patch Third Party Advisory Vendor Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2017/01/10/7 | af854a3a-2127-422b-91ae-364da2661108 | Mailing List Patch Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2017/01/11/4 | af854a3a-2127-422b-91ae-364da2661108 | Mailing List Patch Third Party Advisory |
| http://www.securityfocus.com/bid/95370 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1037576 | af854a3a-2127-422b-91ae-364da2661108 | Third Party Advisory VDB Entry |
| https://access.redhat.com/errata/RHSA-2017:2292 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b | af854a3a-2127-422b-91ae-364da2661108 | Issue Tracking Patch Third Party Advisory |
| https://gnutls.org/security.html#GNUTLS-SA-2017-1 | af854a3a-2127-422b-91ae-364da2661108 | Vendor Advisory |
| https://security.gentoo.org/glsa/201702-04 | af854a3a-2127-422b-91ae-364da2661108 | Patch Third Party Advisory Vendor Advisory |