Security Information / 2013 / Security Information -- DSA-2697-1 gnutls26

Debian Security Advisory

DSA-2697-1 gnutls26 -- out-of-bounds array read

Date Reported:

29 May 2013

Affected Packages:

gnutls26

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 709301.
In Mitre's CVE dictionary: CVE-2013-2116.

More information:

It was discovered that a malicious client could crash a GNUTLS server and vice versa, by sending TLS records encrypted with a block cipher which contain invalid padding.

The oldstable distribution (squeeze) is not affected because the security fix that introduced this vulnerability was not applied to it.

For the stable distribution (wheezy), this problem has been fixed in version 2.12.20-7.

For the unstable distribution (sid), this problem has been fixed in version 2.12.23-5.

We recommend that you upgrade your gnutls26 packages.