CVE-2008-1950

Publication date 21 May 2008

Last updated 24 July 2024


Ubuntu priority

Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.

Status

Package Ubuntu Release Status
gnutls12 8.04 LTS hardy Not in release
7.10 gutsy Not in release
7.04 feisty Not in release
6.06 LTS dapper
Fixed 1.2.9-2ubuntu1.2
gnutls13 8.04 LTS hardy
Fixed 2.0.4-1ubuntu2.1
7.10 gutsy
Fixed 1.6.3-1ubuntu0.1
7.04 feisty
Fixed 1.4.4-3ubuntu0.1
6.06 LTS dapper Not in release
gnutls26 8.04 LTS hardy Not in release
7.10 gutsy Not in release
7.04 feisty Not in release
6.06 LTS dapper Not in release

References

Related Ubuntu Security Notices (USN)

    • USN-613-1
    • GnuTLS vulnerabilities
    • 21 May 2008

Other references