huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2006-2451: Possible privilege escalation through prctl() and suid_dumpable
Component: Possible privilege escalation through prctl() and suid_dumpable
Severity: Important
Public date: 2006-07-06T00:00:00+00:00

The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a local user to cause a denial of service (disk consumption) and possibly gain privileges via the PR_SET_DUMPABLE argument of the prctl function and a program that causes a core dump file to be created in a directory for which the user does not have permissions.


Affected upstream versions: n/a
Upstream repository: https://www.kernel.org/git/linux/kernel/git/stable/linux-2.6.17.y.git
Upstream fix commit: 0af184bb9f80edfbb94de46cb52e9592e5a547b0
CVE-2006-2934: security flaw
Component: security flaw
Severity: Important
Public date: 2006-06-30T00:00:00+00:00

SCTP conntrack (ip_conntrack_proto_sctp.c) in netfilter for Linux kernel 2.6.17 before 2.6.17.3 and 2.6.16 before 2.6.16.23 allows remote attackers to cause a denial of service (crash) via a packet without any chunks, which causes a variable to contain an invalid value that is later used to dereference a pointer.


Affected upstream versions: n/a
Upstream repository: https://www.kernel.org/git/linux/kernel/git/stable/linux-2.6.17.y.git
Upstream fix commit: 9c48e1ea8cf8800cc5e2d39ccbb8b5ff9704f8e9
CVE-2006-3242: security flaw
Component: security flaw
Severity: Moderate
Public date: 2006-06-19T00:00:00+00:00

Stack-based buffer overflow in the browse_get_namespace function in imap/browse.c of Mutt 1.4.2.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via long namespaces received from the IMAP server.


Affected upstream versions: n/a
Upstream repository: https://dev.mutt.org/cgi-bin/mutt/.git
Upstream fix commit: dc0272b749f0e2b102973b7ac43dbd3908507540
CVE-2006-3741: security flaw
Component: security flaw
Severity: Moderate
Public date: 2006-09-08T00:00:00+00:00

The perfmonctl system call (sys_perfmonctl) in Linux kernel 2.4.x and 2.6 before 2.6.18, when running on Itanium systems, does not properly track the reference count for file descriptors, which allows local users to cause a denial of service (file descriptor consumption).


Affected upstream versions: n/a
Fixed upstream versions: v2.6.18
Upstream repository: https://www.kernel.org/git/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: b8444d00762703e1b6146fce12ce2684885f8bf6
CVE-2006-4192: libmodplug: Integer overflow when reading samples of AMF files
Component: libmodplug
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2006-10-06T00:00:00+00:00

Multiple buffer overflows in MODPlug Tracker (OpenMPT) 1.17.02.43 and earlier and libmodplug 0.8 and earlier, as used in GStreamer and possibly other products, allow user-assisted remote attackers to execute arbitrary code via (1) long strings in ITP files used by the CSoundFile::ReadITProject function in soundlib/Load_it.cpp and (2) crafted modules used by the CSoundFile::ReadSample function in soundlib/Sndfile.cpp, as demonstrated by crafted AMF files.


Affected upstream versions: n/a
Fixed upstream versions: RELEASE-0_10_4
Upstream repository: https://cgit.freedesktop.org/gstreamer/gst-plugins-bad
Upstream fix commit: bc2cdd57d549ab3ba59782e9b395d0cd683fd3ac
CVE-2006-4538: kernel: Local DoS with corrupted ELF
Component: kernel
Severity: Moderate
Public date: 2006-08-23T00:00:00+00:00

Linux kernel 2.6.17 and earlier, when running on IA64 or SPARC platforms, allows local users to cause a denial of service (crash) via a malformed ELF file that triggers memory maps that cross region boundaries.


Affected upstream versions: n/a
Upstream repository: https://www.kernel.org/git/linux/kernel/git/stable/linux-2.6.17.y.git
Upstream fix commit: 8833ebaa3f4325820fe3338ccf6fae04f6669254
CVE-2006-4813: security flaw
Component: security flaw
Severity: Important
Public date: 2006-10-11T00:00:00+00:00

The __block_prepare_write function in fs/buffer.c for Linux kernel 2.6.x before 2.6.13 does not properly clear buffers during certain error conditions, which allows local users to read portions of files that have been unlinked.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.13
Upstream repository: https://www.kernel.org/git/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 152becd26e0563aefdbc4fd1fe491928efe92d1f
CVE-2006-4997: security flaw
Component: security flaw
Severity: Moderate
Public date: 2006-09-12T00:00:00+00:00

The clip_mkip function in net/atm/clip.c of the ATM subsystem in Linux kernel allows remote attackers to cause a denial of service (panic) via unknown vectors that cause the ATM subsystem to access the memory of socket buffers after they are freed (freed pointer dereference).


Affected upstream versions: n/a
Fixed upstream versions: v2.6.18
Upstream repository: https://www.kernel.org/git/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: fe26109a9dfd9327fdbe630fc819e1b7450986b2
CVE-2006-5158: NFS lockd deadlock
Component: NFS lockd deadlock
Severity: Moderate
Public date: 2006-09-28T00:00:00+00:00

The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS exports via unspecified vectors that trigger a kernel oops (null dereference) and a deadlock.

Statement: This issue does not affect Red Hat Enterprise Linux 2.1 or 3.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.15
Upstream repository: https://www.kernel.org/git/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 9b5b1f5bf9dcdb6f23abf65977a675eb4deba3c0
CVE-2006-5174: security flaw
Component: security flaw
Severity: Important
Public date: 2006-09-28T00:00:00+00:00

The copy_from_user function in the uaccess code in Linux kernel 2.6 before 2.6.19-rc1, when running on s390, does not properly clear a kernel buffer, which allows local user space programs to read portions of kernel memory by "appending to a file from a bad address," which triggers a fault that prevents the unused memory from being cleared in the kernel buffer.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.19
Upstream repository: https://www.kernel.org/git/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 52149ba6b0ddf3e9d965257cc0513193650b3ea8
CVE-2006-5619: security flaw
Component: security flaw
Severity: Important
Public date: 2006-10-31T00:00:00+00:00

The seqfile handling (ip6fl_get_n function in ip6_flowlabel.c) in Linux kernel 2.6 up to 2.6.18-stable allows local users to cause a denial of service (hang or oops) via unspecified manipulations that trigger an infinite loop while searching for flowlabels.

Statement: Red Hat is aware of this issue and are tracking it via bug 213214 for Red Hat Enterprise Linux 4:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=213214

This issue does not affect Red Hat Enterprise Linux 2.1 or 3

Affected upstream versions: n/a
Fixed upstream versions: v2.6.19
Upstream repository: https://www.kernel.org/git/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: bcd620757d3a4ae78ef0ca41adb5d9e400ed92b6
CVE-2006-5751: Linux kernel get_fdb_entries() integer overflow
Component: Linux kernel get_fdb_entries() integer overflow
Severity: Important
Public date: 2006-11-29T00:00:00+00:00

Integer overflow in the get_fdb_entries function in net/bridge/br_ioctl.c in the Linux kernel before 2.6.18.4 allows local users to execute arbitrary code via a large maxnum value in an ioctl request.

Statement: This flaw does not affect the Linux kernel shipped with Red Hat Enterprise Linux 2.1 or 3.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.19
Upstream repository: https://www.kernel.org/git/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ba8379b220509e9448c00a77cf6c15ac2a559cc7
CVE-2006-5755: kernel: local denial of service due to NT bit leakage
Component: kernel
Severity: Low
Public date: 2006-09-26T00:00:00+00:00

Linux kernel before 2.6.18, when running on x86_64 systems, does not properly save or restore EFLAGS during a context switch, which allows local users to cause a denial of service (crash) by causing SYSENTER to set an NT flag, which can trigger a crash on the IRET of the next task.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.19
Upstream repository: https://kernel.org/git/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 658fdbef66e5e9be79b457edc2cbbb3add840aa9
CVE-2006-7203: oops in compat_sys_mount() when data pointer is NULL
Component: oops in compat_sys_mount() when data pointer is NULL
Severity: Important
Public date: 2007-05-15T00:00:00+00:00

The compat_sys_mount function in fs/compat.c in Linux kernel 2.6.20 and earlier allows local users to cause a denial of service (NULL pointer dereference and oops) by mounting a smbfs file system in compatibility mode ("mount -t smbfs").


Affected upstream versions: n/a
Fixed upstream versions: v2.6.20
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 822191a2fa1584a29c3224ab328507adcaeac1ab
CVE-2007-1592: IPv6 oops triggerable by any user
Component: IPv6 oops triggerable by any user
Severity: Important
Public date: 2007-03-16T00:00:00+00:00

net/ipv6/tcp_ipv6.c in Linux kernel 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6_fl_socklist from a listening TCP socket to child sockets, which allows local users to cause a denial of service (OOPS) or double free by opening a listening IPv6 socket, attaching a flow label, and connecting to that socket.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.21
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: d35690beda1429544d46c8eb34b2e3a8c37ab299
CVE-2007-3731: NULL pointer dereference triggered by ptrace
Component: NULL pointer dereference triggered by ptrace
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2007-07-15T00:00:00+00:00

The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs (the xcs field) during ptrace single-step operations, which allows local users to cause a denial of service (NULL dereference and OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP requests, related to the TRACE_IRQS_ON function, and possibly related to the arch_ptrace function.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, or 4.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.23
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: a10d9a71bafd3a283da240d2868e71346d2aef6f
CVE-2007-3850: kernel LTC31426-4k page mapping support for userspace in 64k kernels
Component: kernel LTC31426-4k page mapping support for userspace in 64k kernels
Severity: Moderate
Public date: 2007-04-03T00:00:00+00:00

The eHCA driver in Linux kernel 2.6 before 2.6.22, when running on PowerPC, does not properly map userspace resources, which allows local users to read portions of physical address space.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.22
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 721151d004dcf01a71b12bb6b893f9160284cf6e
CVE-2007-4567: kernel: ipv6_hop_jumbo remote system crash
Component: kernel
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2007-09-07T00:00:00+00:00

The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.22 does not properly validate the hop-by-hop IPv6 extended header, which allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted IPv6 packet.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and Red Hat Enterprise MRG. Shipped kernels do not include upstream commit a11d206d that introduced the problem.

This upstream commit was backported in Red Hat Enterprise Linux 5 via RHBA-2008:0314. It was reported and addressed in Red Hat Enterprise Linux 5 via RHSA-2010:0019.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.22
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: e76b2b2567b83448c2ee85a896433b96150c92e6
CVE-2007-4571: ALSA memory disclosure flaw
Component: ALSA memory disclosure flaw
Severity: Moderate
Public date: 2007-09-25T00:00:00+00:00

The snd_mem_proc_read function in sound/core/memalloc.c in the Advanced Linux Sound Architecture (ALSA) in the Linux kernel before 2.6.22.8 does not return the correct write size, which allows local users to obtain sensitive information (kernel memory contents) via a small count argument, as demonstrated by multiple reads of /proc/driver/snd-page-alloc.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 2.1 or 3.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.23
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ccec6e2c4a74adf76ed4e2478091a311b1806212
CVE-2007-4997: kernel ieee80211 off-by-two integer underflow
Component: kernel ieee80211 off-by-two integer underflow
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2007-10-02T00:00:00+00:00

Integer underflow in the ieee80211_rx function in net/ieee80211/ieee80211_rx.c in the Linux kernel 2.6.x before 2.6.23 allows remote attackers to cause a denial of service (crash) via a crafted SKB length value in a runt IEEE 802.11 frame when the IEEE80211_STYPE_QOS_DATA flag is set, aka an "off-by-two error."


Affected upstream versions: n/a
Fixed upstream versions: v2.6.23
Upstream repository: https://git.kernel.org/linux/kernel/git/avi/kvm.git
Upstream fix commit: 04045f98e0457aba7d4e6736f37eed189c48a5f7
CVE-2007-5191: util-linux (u)mount doesn't drop privileges properly when calling helpers
Component: util-linux (u)mount doesn't drop privileges properly when calling helpers
Severity: Moderate
Public date: 2007-09-20T00:00:00+00:00

mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.


Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/utils/util-linux-ng/util-linux-ng.git
Upstream fix commit: ebbeb2c7ac1b00b6083905957837a271e80b187e
CVE-2007-5500: kernel hang via userspace PTRACE+waitid
Component: kernel hang via userspace PTRACE+waitid
Severity: Important
Public date: 2007-11-16T00:00:00+00:00

The wait_task_stopped function in the Linux kernel before 2.6.23.8 checks a TASK_TRACED bit instead of an exit_state value, which allows local users to cause a denial of service (machine crash) via unspecified vectors.  NOTE: some of these details are obtained from third party information.


Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/linux/kernel/git/stable/linux-2.6.23.y.git
Upstream fix commit: 36ef66c5d137b9a31fd8c35d236fb9e26ef74f97
CVE-2007-5503: cairo integer overflow
Component: cairo integer overflow
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2007-11-29T00:00:00+00:00

Multiple integer overflows in Cairo before 1.4.12 might allow remote attackers to execute arbitrary code, as demonstrated using a crafted PNG image with large width and height values, which is not properly handled by the read_png function.


Affected upstream versions: n/a
Upstream repository: https://gitweb.freedesktop.org/cairo
Upstream fix commit: e49bcde27f88e21d5b8037a0089a226096f6514b
CVE-2007-5904: Buffer overflow in CIFS VFS
Component: Buffer overflow in CIFS VFS
Severity: Moderate
Public date: 2007-11-08T00:00:00+00:00

Multiple buffer overflows in CIFS VFS in Linux kernel 2.6.23 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long SMB responses that trigger the overflows in the SendReceive function.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.24
Upstream repository: https://git.kernel.org/linux/kernel/git/sfrench/cifs-2.6.git
Upstream fix commit: 133672efbc1085f9af990bdc145e1822ea93bcf3
CVE-2007-5938: NULL dereference in iwl driver
Component: NULL dereference in iwl driver
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2007-11-20T00:00:00+00:00

The iwl_set_rate function in compatible/iwl3945-base.c in iwlwifi 1.1.21 and earlier dereferences an iwl_get_hw_mode return value without checking for NULL, which might allow remote attackers to cause a denial of service (kernel panic) via unspecified vectors during module initialization.


Affected upstream versions: n/a
Upstream repository: https://www.intellinuxwireless.org/repos/iwlwifi.git
Upstream fix commit: 25db44d4cdfe31d59223d74cb577f4a71aff1a40
CVE-2007-6151: I4L: fix isdn_ioctl memory issue
Component: I4L
Severity: Low
Public date: 2007-12-01T00:00:00+00:00

The isdn_ioctl function in isdn_common.c in Linux kernel 2.6.23 allows local users to cause a denial of service via a crafted ioctl struct in which iocts is not null terminated, which triggers a buffer overflow.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.24
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: eafe1aa37e6ec2d56f14732b5240c4dd09f0613a
CVE-2007-6206: Issue with core dump owner
Component: Issue with core dump owner
Severity: Moderate
Public date: 2004-07-10T00:00:00+00:00

The do_coredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions, does not change the UID of a core dump file if it exists before a root process creates a core dump in the same location, which might allow local users to obtain sensitive information.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.24
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: c46f739dd39db3b07ab5deb4e3ec81e1c04a91af
CVE-2007-6712: kernel: infinite loop in highres timers (kernel hang)
Component: kernel
Severity: Important
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2007-03-16T00:00:00+00:00

Integer overflow in the hrtimer_forward function (hrtimer.c) in Linux kernel 2.6.21-rc4, when running on 64-bit systems, allows local users to cause a denial of service (infinite loop) via a timer with a large expiry value, which causes the timer to always be expired.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.21
Upstream repository: https://git.kernel.org/linux/kernel/git/chris/linux-2.6.git
Upstream fix commit: 13788ccc41ceea5893f9c747c59bc0b28f2416c2
CVE-2007-6716: kernel: dio: zero struct dio with kzalloc instead of manually
Component: kernel
Severity: Important
Public date: 2007-07-26T00:00:00+00:00

fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as demonstrated by a certain fio test.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.23
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 848c4dd5153c7a0de55470ce99a8e13a63b4703f
CVE-2008-0001: kernel: filesystem corruption by unprivileged user via directory truncation
Component: kernel
Severity: Important
Public date: 2008-01-12T00:00:00+00:00

VFS in the Linux kernel before 2.6.22.16, and 2.6.23.x before 2.6.23.14, performs tests of access mode by using the flag variable instead of the acc_mode variable, which might allow local users to bypass intended permissions and remove directories.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.24
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 974a9f0b47da74e28f68b9c8645c3786aa5ace1a
CVE-2008-1294: kernel: setrlimit(RLIMIT_CPUINFO) with zero value doesn't inherit properly across children
Component: kernel
Severity: Moderate
Public date: 2007-04-17T00:00:00+00:00

Linux kernel 2.6.17, and other versions before 2.6.22, does not check when a user attempts to set RLIMIT_CPU to 0 until after the change is made, which allows local users to bypass intended resource limits.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and Red Hat Enterprise MRG.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.22
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 9926e4c74300c4b31dee007298c6475d33369df0
CVE-2008-1367: Kernel doesn't clear DF for signal handlers
Component: Kernel doesn't clear DF for signal handlers
Severity: Low
Public date: 2008-03-05T00:00:00+00:00

gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signal handling in the Linux kernel, which might allow context-dependent attackers to trigger memory corruption. NOTE: this issue was originally reported for CPU consumption in SBCL.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.25
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: e40cd10ccff3d9fbffd57b93780bee4b7b9bff51
CVE-2008-1514: kernel: ptrace: Padding area write - unprivileged kernel crash
Component: kernel
Severity: Important
Public date: 2008-03-18T00:00:00+00:00

arch/s390/kernel/ptrace.c in Linux kernel 2.6.9, and other versions before 2.6.27-rc6, on s390 platforms allows local users to cause a denial of service (kernel panic) via the user-area-padding test from the ptrace testsuite in 31-bit mode, which triggers an invalid dereference.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 5, and Red Hat Enterprise MRG.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.27
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 3d6e48f43340343d97839eadb1ab7b6a3ea98797
CVE-2008-1926: util-linux: audit log injection via login
Component: util-linux
Severity: Low
Public date: 2008-04-21T00:00:00+00:00

Argument injection vulnerability in login (login-utils/login.c) in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an "addr=" statement to the login name, aka "audit log injection."


Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/utils/util-linux-ng/util-linux-ng.git
Upstream fix commit: 8ccf0b253ac0f4f58d64bc9674de18bff5a88782
CVE-2008-1948: GNUTLS-SA-2008-1-1 GnuTLS buffer overflow
Component: GNUTLS-SA-2008-1-1 GnuTLS buffer overflow
Severity: Critical
Public date: 2008-05-19T00:00:00+00:00

The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a zero value for the length of Server Names, which leads to a buffer overflow in session resumption data in the pack_security_parameters function, aka GNUTLS-SA-2008-1-1.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/gitweb/gnutls.git
Upstream fix commit: bc8102405fda11ea00ca3b42acc4f4bce9d6e97b