CVE-2010-0731
26.03.2010, 18:30
The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.Enginsight
| Vendor | Product | Version |
|---|---|---|
| gnu | gnutls | 𝑥 ≤ 1.2.0 |
| gnu | gnutls | 1.0.16 |
| gnu | gnutls | 1.0.17 |
| gnu | gnutls | 1.0.18 |
| gnu | gnutls | 1.0.19 |
| gnu | gnutls | 1.0.20 |
| gnu | gnutls | 1.0.21 |
| gnu | gnutls | 1.0.22 |
| gnu | gnutls | 1.0.23 |
| gnu | gnutls | 1.0.24 |
| gnu | gnutls | 1.0.25 |
| gnu | gnutls | 1.1.13 |
| gnu | gnutls | 1.1.14 |
| gnu | gnutls | 1.1.15 |
| gnu | gnutls | 1.1.16 |
| gnu | gnutls | 1.1.17 |
| gnu | gnutls | 1.1.18 |
| gnu | gnutls | 1.1.19 |
| gnu | gnutls | 1.1.20 |
| gnu | gnutls | 1.1.21 |
| gnu | gnutls | 1.1.22 |
| gnu | gnutls | 1.1.23 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
References