Bug 389947 (CVE-2011-4128)

Summary:	<net-libs/gnutls-2.12.18: Possible buffer overflow/Denial of service (CVE-2011-4128)
Product:	Gentoo Security	Reporter:	Hanno Böck <hanno>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	crypto+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [glsa]
Package list:		Runtime testing required:	---

Description Hanno Böck gentoo-dev

2011-11-09 10:41:56 UTC

See
http://www.gnu.org/s/gnutls/security.html

Fix only for 2.12 and 3.0. It seems gnutls upstream considers 2.10.x deprecated and provides no more security updates. So it's probably time to unmask latest gnutls versions in portage.

Comment 1 GLSAMaker/CVETool Bot gentoo-dev

2011-12-13 00:33:08 UTC

CVE-2011-4128 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4128):
  Buffer overflow in the gnutls_session_get_data function in
  lib/gnutls_session.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7,
  when used on a client that performs nonstandard session resumption, allows
  remote TLS servers to cause a denial of service (application crash) via a
  large SessionTicket.

Comment 2 Sean Amoss (RETIRED) gentoo-dev

2012-05-17 22:43:11 UTC

Added to existing GLSA request.

Comment 3 GLSAMaker/CVETool Bot gentoo-dev

2012-06-23 14:41:25 UTC

This issue was resolved and addressed in
 GLSA 201206-18 at http://security.gentoo.org/glsa/glsa-201206-18.xml
by GLSA coordinator Sean Amoss (ackle).