CVE-2014-8564

Published: 10 November 2014

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

Priority

Medium

Status

Package Release Status
gnutls26
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 ESM (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable
(code not present)
gnutls28
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 18.04 LTS (Bionic Beaver)
Released (3.3.8-3ubuntu2)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (3.3.8-3ubuntu2)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was needed)
Patches:
Upstream: https://gitorious.org/gnutls/gnutls/commit/e821e1908686657a45c1b735f6d077b7a8493e2b (3.3.x)
Upstream: https://gitorious.org/gnutls/gnutls/commit/a737abecf1affa08469ca2e9804eb3b6e95027e9 (3.2.x)
Upstream: https://gitorious.org/gnutls/gnutls/commit/7429872b74c8216bbf15e241e47aba94369ef083 (3.1.x)
Upstream: https://gitorious.org/gnutls/gnutls/commit/470ade2a99ec5bcfb1b191b175bc1943aa50f359 (head)
Upstream: https://gitorious.org/gnutls/gnutls/commit/77f6de42a5beeec09599dfa5f9e5574725bd8cbf (test)