Security update for gnutls SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:0304-1 Final 1 1 2017-01-27T17:23:55Z current 2017-01-27T17:23:55Z 2017-01-27T17:23:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gnutls This update for gnutls fixes the following issues: - Malformed asn1 definitions could cause a segmentation fault in the asn1 definition parser (bsc#961491). - CVE-2016-8610: Remote denial of service in SSL alert handling (bsc#1005879). - CVE-2017-5335: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). - CVE-2017-5336: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). - CVE-2017-5337: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-gnutls-12957,slehasp4-gnutls-12957,slessp4-gnutls-12957 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20170304-1/ Link for SUSE-SU-2017:0304-1 https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00063.html E-Mail link for SUSE-SU-2017:0304-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1005879 SUSE Bug 1005879 https://bugzilla.suse.com/1018832 SUSE Bug 1018832 https://bugzilla.suse.com/961491 SUSE Bug 961491 https://www.suse.com/security/cve/CVE-2016-8610/ SUSE CVE CVE-2016-8610 page https://www.suse.com/security/cve/CVE-2017-5335/ SUSE CVE CVE-2017-5335 page https://www.suse.com/security/cve/CVE-2017-5336/ SUSE CVE CVE-2017-5336 page https://www.suse.com/security/cve/CVE-2017-5337/ SUSE CVE CVE-2017-5337 page SUSE Linux Enterprise High Availability Extension 11 SP4 SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 libgnutls-devel-2.4.1-24.39.67.1 libgnutls-extra-devel-2.4.1-24.39.67.1 libgnutls-extra26-2.4.1-24.39.67.1 gnutls-2.4.1-24.39.67.1 libgnutls26-2.4.1-24.39.67.1 libgnutls26-32bit-2.4.1-24.39.67.1 libgnutls26-x86-2.4.1-24.39.67.1 libgnutls-extra26-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise High Availability Extension 11 SP4 gnutls-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Server 11 SP4 libgnutls-extra26-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Server 11 SP4 libgnutls26-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Server 11 SP4 libgnutls26-32bit-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Server 11 SP4 libgnutls26-x86-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Server 11 SP4 gnutls-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libgnutls-extra26-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libgnutls26-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libgnutls26-32bit-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libgnutls26-x86-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libgnutls-devel-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libgnutls-extra-devel-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libgnutls-extra26-2.4.1-24.39.67.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. CVE-2016-8610 SUSE Linux Enterprise High Availability Extension 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:gnutls-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-32bit-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-x86-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gnutls-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-32bit-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-x86-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-devel-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-extra-devel-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170304-1/ https://www.suse.com/security/cve/CVE-2016-8610.html CVE-2016-8610 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1005879 SUSE Bug 1005879 https://bugzilla.suse.com/1110018 SUSE Bug 1110018 https://bugzilla.suse.com/1120592 SUSE Bug 1120592 https://bugzilla.suse.com/1126909 SUSE Bug 1126909 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 https://bugzilla.suse.com/982575 SUSE Bug 982575 The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate. CVE-2017-5335 SUSE Linux Enterprise High Availability Extension 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:gnutls-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-32bit-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-x86-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gnutls-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-32bit-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-x86-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-devel-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-extra-devel-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170304-1/ https://www.suse.com/security/cve/CVE-2017-5335.html CVE-2017-5335 https://bugzilla.suse.com/1018832 SUSE Bug 1018832 https://bugzilla.suse.com/1021057 SUSE Bug 1021057 Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate. CVE-2017-5336 SUSE Linux Enterprise High Availability Extension 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:gnutls-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-32bit-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-x86-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gnutls-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-32bit-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-x86-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-devel-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-extra-devel-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170304-1/ https://www.suse.com/security/cve/CVE-2017-5336.html CVE-2017-5336 https://bugzilla.suse.com/1018832 SUSE Bug 1018832 https://bugzilla.suse.com/1021057 SUSE Bug 1021057 Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate. CVE-2017-5337 SUSE Linux Enterprise High Availability Extension 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:gnutls-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-32bit-2.4.1-24.39.67.1 SUSE Linux Enterprise Server 11 SP4:libgnutls26-x86-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:gnutls-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-32bit-2.4.1-24.39.67.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgnutls26-x86-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-devel-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-extra-devel-2.4.1-24.39.67.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgnutls-extra26-2.4.1-24.39.67.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170304-1/ https://www.suse.com/security/cve/CVE-2017-5337.html CVE-2017-5337 https://bugzilla.suse.com/1018832 SUSE Bug 1018832 https://bugzilla.suse.com/1021057 SUSE Bug 1021057