Every CVE Search/ Get API key

CVE-2014-8564

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x...

5.0 MediumFix available

CVE-2014-8564 is a medium vulnerability (CVSS 5.0) in Gnu Gnutls, published November 13, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.28%, the 88th percentile. Fixed in gnutls28 3.3.8-4.

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

Exploit likelihood

3.28%Up 2.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

Record
CVE-2014-8564
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

Record
CVE-2014-8564
Updated
2026-11-02
EUVDEUVD-2014-8401 No score

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

Record
EUVD-2014-8401
Updated
2026-11-03
GitHub AdvisoriesGHSA-rp47-7r25-f53m No score

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x...

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

Record
GHSA-rp47-7r25-f53m
Updated
2026-11-02
OSV No score

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

Record
CVE-2014-8564
Updated
2026-11-02
OSVDEBIAN-CVE-2014-8564 No score

The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.

Record
DEBIAN-CVE-2014-8564
Updated
2026-11-02
OSVMGASA-2014-0458 No score

Updated gnutls package fix security vulnerability

An out-of-bounds memory write flaw was found in the way GnuTLS parsed certain ECC (Elliptic Curve Cryptography) certificates or certificate signing requests (CSR). A malicious user could create a specially crafted ECC certificate or a certificate signing request that, when processed by an application compiled against GnuTLS (for example, certtool), could cause that application to crash or execute arbitrary code with the permissions of the user running the application (CVE-2014-8564).

Record
MGASA-2014-0458
Updated
2026-11-02
OSVopenSUSE-SU-2024:10105-1 No score

gnutls-3.4.15-1.1 on GA media

These are all security issues fixed in the gnutls-3.4.15-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10105-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gnutls28
Debian:12
 before 3.3.8-4
3.3.8-4
gnutls28
Debian:13
 before 3.3.8-4
3.3.8-4
gnutls28
Debian:14
 before 3.3.8-4
3.3.8-4
gnutls
Mageia:3
 before 3.1.16-1.4.mga3
3.1.16-1.4.mga3
gnutls
Mageia:4
 before 3.2.7-1.4.mga4
3.2.7-1.4.mga4
gnutls
Red Hat:enterprise_linux:7::client
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-dane
Red Hat:enterprise_linux:7::client
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-utils
Red Hat:enterprise_linux:7::client
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-c++
Red Hat:enterprise_linux:7::client
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
Show 20 moreShow less
Affected packages
PackageAffectedFixed
gnutls-devel
Red Hat:enterprise_linux:7::client
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls
Red Hat:enterprise_linux:7::computenode
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-dane
Red Hat:enterprise_linux:7::computenode
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-utils
Red Hat:enterprise_linux:7::computenode
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-c++
Red Hat:enterprise_linux:7::computenode
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls
Red Hat:enterprise_linux:7::server
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-c++
Red Hat:enterprise_linux:7::server
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-dane
Red Hat:enterprise_linux:7::server
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-devel
Red Hat:enterprise_linux:7::server
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-utils
Red Hat:enterprise_linux:7::server
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls
Red Hat:enterprise_linux:7::workstation
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-c++
Red Hat:enterprise_linux:7::workstation
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-dane
Red Hat:enterprise_linux:7::workstation
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls-utils
Red Hat:enterprise_linux:7::workstation
 before 0:3.1.18-10.el7_0
0:3.1.18-10.el7_0
gnutls
openSUSE:Tumbleweed
 before 3.4.15-1.1
3.4.15-1.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open