CVE-2017-7869

GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 72%
Affected Products (NVD)
VendorProductVersion
gnugnutls
𝑥
≤ 3.5.9
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
gnutls28
bookworm
3.7.9-2+deb12u3
fixed
bullseye
3.7.1-5+deb11u5
fixed
bullseye (security)
3.7.1-5+deb11u6
fixed
sid
3.8.6-2
fixed
trixie
3.8.6-2
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gnutls26
artful
dne
bionic
dne
cosmic
dne
disco
dne
eoan
dne
focal
dne
groovy
dne
hirsute
dne
precise
ignored
trusty
Fixed 2.12.23-12ubuntu2.8
released
xenial
dne
yakkety
dne
zesty
dne
gnutls28
artful
not-affected
bionic
not-affected
cosmic
not-affected
disco
not-affected
eoan
not-affected
focal
not-affected
groovy
not-affected
hirsute
not-affected
precise
ignored
trusty
dne
xenial
Fixed 3.4.10-4ubuntu1.3
released
yakkety
Fixed 3.5.3-5ubuntu1.2
released
zesty
Fixed 3.5.6-4ubuntu4.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
gnutls
suse enterprise desktop 15
3.6.2-4.15
fixed
suse enterprise desktop 15 SP1
3.6.7-6.8.1
fixed
suse enterprise desktop 15 SP2
3.6.7-12.1
fixed
suse enterprise desktop 15 SP3
3.6.7-14.10.2
fixed
suse enterprise desktop 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise desktop 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise desktop 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise desktop 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise sap 12 SP2
3.2.15-18.3.1
fixed
suse enterprise sap 15
3.6.2-4.15
fixed
suse enterprise sap 15 SP1
3.6.7-6.8.1
fixed
suse enterprise sap 15 SP2
3.6.7-12.1
fixed
suse enterprise sap 15 SP3
3.6.7-14.10.2
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise sap 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise sap 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise sap 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise server 12 SP2
3.2.15-18.3.1
fixed
suse enterprise server 15
3.6.2-4.15
fixed
suse enterprise server 15 SP1
3.6.7-6.8.1
fixed
suse enterprise server 15 SP2
3.6.7-12.1
fixed
suse enterprise server 15 SP3
3.6.7-14.10.2
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise server 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise server 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise server 15 SP7
3.8.3-150600.4.6.2
fixed
libgnutls-devel
suse enterprise desktop 15
3.6.2-4.15
fixed
suse enterprise desktop 15 SP1
3.6.7-6.8.1
fixed
suse enterprise desktop 15 SP2
3.6.7-12.1
fixed
suse enterprise desktop 15 SP3
3.6.7-14.10.2
fixed
suse enterprise desktop 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise desktop 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise desktop 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise desktop 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise sap 15
3.6.2-4.15
fixed
suse enterprise sap 15 SP1
3.6.7-6.8.1
fixed
suse enterprise sap 15 SP2
3.6.7-12.1
fixed
suse enterprise sap 15 SP3
3.6.7-14.10.2
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise sap 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise sap 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise sap 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise server 15
3.6.2-4.15
fixed
suse enterprise server 15 SP1
3.6.7-6.8.1
fixed
suse enterprise server 15 SP2
3.6.7-12.1
fixed
suse enterprise server 15 SP3
3.6.7-14.10.2
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise server 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise server 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise server 15 SP7
3.8.3-150600.4.6.2
fixed
libgnutls-openssl27
suse enterprise sap 12 SP2
3.2.15-18.3.1
fixed
suse enterprise server 12 SP2
3.2.15-18.3.1
fixed
libgnutls28
suse enterprise sap 12 SP2
3.2.15-18.3.1
fixed
suse enterprise server 12 SP2
3.2.15-18.3.1
fixed
libgnutls28-32bit
suse enterprise sap 12 SP2
3.2.15-18.3.1
fixed
suse enterprise server 12 SP2
3.2.15-18.3.1
fixed
libgnutls30
suse enterprise desktop 15
3.6.2-4.15
fixed
suse enterprise desktop 15 SP1
3.6.7-6.8.1
fixed
suse enterprise desktop 15 SP2
3.6.7-12.1
fixed
suse enterprise desktop 15 SP3
3.6.7-14.10.2
fixed
suse enterprise desktop 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise desktop 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise desktop 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise desktop 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise sap 15
3.6.2-4.15
fixed
suse enterprise sap 15 SP1
3.6.7-6.8.1
fixed
suse enterprise sap 15 SP2
3.6.7-12.1
fixed
suse enterprise sap 15 SP3
3.6.7-14.10.2
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise sap 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise sap 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise sap 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise server 15
3.6.2-4.15
fixed
suse enterprise server 15 SP1
3.6.7-6.8.1
fixed
suse enterprise server 15 SP2
3.6.7-12.1
fixed
suse enterprise server 15 SP3
3.6.7-14.10.2
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise server 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise server 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise server 15 SP7
3.8.3-150600.4.6.2
fixed
libgnutls30-32bit
suse enterprise desktop 15 SP1
3.6.7-6.8.1
fixed
suse enterprise desktop 15 SP2
3.6.7-12.1
fixed
suse enterprise desktop 15 SP3
3.6.7-14.10.2
fixed
suse enterprise desktop 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise desktop 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise desktop 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise desktop 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise sap 15 SP1
3.6.7-6.8.1
fixed
suse enterprise sap 15 SP2
3.6.7-12.1
fixed
suse enterprise sap 15 SP3
3.6.7-14.10.2
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise sap 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise sap 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise sap 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise server 15 SP1
3.6.7-6.8.1
fixed
suse enterprise server 15 SP2
3.6.7-12.1
fixed
suse enterprise server 15 SP3
3.6.7-14.10.2
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise server 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise server 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise server 15 SP7
3.8.3-150600.4.6.2
fixed
libgnutls30-hmac
suse enterprise desktop 15 SP2
3.6.7-12.1
fixed
suse enterprise desktop 15 SP3
3.6.7-14.10.2
fixed
suse enterprise desktop 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise desktop 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise sap 15 SP2
3.6.7-12.1
fixed
suse enterprise sap 15 SP3
3.6.7-14.10.2
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise sap 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise server 15 SP2
3.6.7-12.1
fixed
suse enterprise server 15 SP3
3.6.7-14.10.2
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise server 15 SP5
3.7.3-150400.4.35.1
fixed
libgnutls30-hmac-32bit
suse enterprise desktop 15 SP2
3.6.7-12.1
fixed
suse enterprise desktop 15 SP3
3.6.7-14.10.2
fixed
suse enterprise desktop 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise desktop 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise sap 15 SP2
3.6.7-12.1
fixed
suse enterprise sap 15 SP3
3.6.7-14.10.2
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise sap 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise server 15 SP2
3.6.7-12.1
fixed
suse enterprise server 15 SP3
3.6.7-14.10.2
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise server 15 SP5
3.7.3-150400.4.35.1
fixed
libgnutlsxx-devel
suse enterprise desktop 15
3.6.2-4.15
fixed
suse enterprise desktop 15 SP1
3.6.7-6.8.1
fixed
suse enterprise desktop 15 SP2
3.6.7-12.1
fixed
suse enterprise desktop 15 SP3
3.6.7-14.10.2
fixed
suse enterprise desktop 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise desktop 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise desktop 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise desktop 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise sap 15
3.6.2-4.15
fixed
suse enterprise sap 15 SP1
3.6.7-6.8.1
fixed
suse enterprise sap 15 SP2
3.6.7-12.1
fixed
suse enterprise sap 15 SP3
3.6.7-14.10.2
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise sap 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise sap 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise sap 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise server 15
3.6.2-4.15
fixed
suse enterprise server 15 SP1
3.6.7-6.8.1
fixed
suse enterprise server 15 SP2
3.6.7-12.1
fixed
suse enterprise server 15 SP3
3.6.7-14.10.2
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise server 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise server 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise server 15 SP7
3.8.3-150600.4.6.2
fixed
libgnutlsxx28
suse enterprise desktop 15
3.6.2-4.15
fixed
suse enterprise desktop 15 SP1
3.6.7-6.8.1
fixed
suse enterprise desktop 15 SP2
3.6.7-12.1
fixed
suse enterprise desktop 15 SP3
3.6.7-14.10.2
fixed
suse enterprise desktop 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise desktop 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise sap 15
3.6.2-4.15
fixed
suse enterprise sap 15 SP1
3.6.7-6.8.1
fixed
suse enterprise sap 15 SP2
3.6.7-12.1
fixed
suse enterprise sap 15 SP3
3.6.7-14.10.2
fixed
suse enterprise sap 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise sap 15 SP5
3.7.3-150400.4.35.1
fixed
suse enterprise server 15
3.6.2-4.15
fixed
suse enterprise server 15 SP1
3.6.7-6.8.1
fixed
suse enterprise server 15 SP2
3.6.7-12.1
fixed
suse enterprise server 15 SP3
3.6.7-14.10.2
fixed
suse enterprise server 15 SP4
3.7.3-150400.2.12
fixed
suse enterprise server 15 SP5
3.7.3-150400.4.35.1
fixed
libgnutlsxx30
suse enterprise desktop 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise desktop 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise sap 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise sap 15 SP7
3.8.3-150600.4.6.2
fixed
suse enterprise server 15 SP6
3.8.3-150600.2.15
fixed
suse enterprise server 15 SP7
3.8.3-150600.4.6.2
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
gnutls
RHEL 7
0:3.3.26-9.el7
fixed
gnutls-c
RHEL 7
0:3.3.26-9.el7
fixed
gnutls-dane
RHEL 7
0:3.3.26-9.el7
fixed
gnutls-devel
RHEL 7
0:3.3.26-9.el7
fixed
gnutls-utils
RHEL 7
0:3.3.26-9.el7
fixed
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/97040
https://access.redhat.com/errata/RHSA-2017:2292
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420
https://gitlab.com/gnutls/gnutls/commit/51464af713d71802e3c6d5ac15f1a95132a354fe
https://www.gnutls.org/security.html
http://www.securityfocus.com/bid/97040
https://access.redhat.com/errata/RHSA-2017:2292
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420
https://gitlab.com/gnutls/gnutls/commit/51464af713d71802e3c6d5ac15f1a95132a354fe
https://www.gnutls.org/security.html