CVE-2015-6251
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers...
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
Exploit likelihood
What each source reports
NVD Score used
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
- Record
CVE-2015-6251- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
- Record
CVE-2015-6251- Updated
- 2026-11-02
EUVDEUVD-2015-6193 No score
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
- Record
EUVD-2015-6193- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-63p6-5792-gpfq No score
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers...
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
- Record
GHSA-63p6-5792-gpfq- Updated
- 2026-11-02
OSV No score
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
- Record
CVE-2015-6251- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-6251 No score
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
- Record
DEBIAN-CVE-2015-6251- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2015-0322 No score
Updated gnutls packages fix security vulnerabilities
It was reported that GnuTLS does not check whether the two signature algorithms match on certificate import (CVE-2015-0294).
Kurt Roeckx discovered that decoding a specific certificate with very long DistinguishedName (DN) entries leads to double free. A remote attacker can take advantage of this flaw by creating a specially crafted certificate that, when processed by an application compiled against GnuTLS, could cause the application to crash resulting in a denial of service (CVE-2015-6251).
- Record
MGASA-2015-0322- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10105-1 No score
gnutls-3.4.15-1.1 on GA media
These are all security issues fixed in the gnutls-3.4.15-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10105-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1518-1 No score
Security update for gnutls
gnutls was updated to fix several security vulnerabilities.
- fix double free in certificate DN decoding (GNUTLS-SA-2015-3)(bsc#941794,CVE-2015-6251)
- fix invalid read in octet string in bundled libtasn1 (bsc#929414,CVE-2015-3622)
- fix ServerKeyExchange signature issue (GNUTLS-SA-2015-2)(bsc#929690)
- Record
SUSE-SU-2015:1518-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-6251 No score
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.
- Record
UBUNTU-CVE-2015-6251- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnutls28Debian:12 |
before 3.3.17-1 | 3.3.17-1 |
gnutls28Debian:13 |
before 3.3.17-1 | 3.3.17-1 |
gnutls28Debian:14 |
before 3.3.17-1 | 3.3.17-1 |
gnutls28Debian:8 |
before 3.3.8-6+deb8u2, plus listed versions 3.3.8-63.3.8-6+deb8u1 |
3.3.8-6+deb8u2 |
gnutlsMageia:4 From an advisory covering 2 CVEs |
before 3.2.7-1.7.mga4 | 3.2.7-1.7.mga4 |
gnutlsMageia:5 From an advisory covering 2 CVEs |
before 3.2.21-1.1.mga5 | 3.2.21-1.1.mga5 |
gnutlsSUSE:Linux Enterprise Desktop 12 From an advisory covering 2 CVEs |
before 3.2.15-11.1 | 3.2.15-11.1 |
gnutlsSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 2 CVEs |
before 3.2.15-11.1 | 3.2.15-11.1 |
gnutlsSUSE:Linux Enterprise Server 12 From an advisory covering 2 CVEs |
before 3.2.15-11.1 | 3.2.15-11.1 |
gnutlsSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 2 CVEs |
before 3.2.15-11.1 | 3.2.15-11.1 |
gnutls28Ubuntu:16.04:LTS |
before 3.3.15-5ubuntu2 | 3.3.15-5ubuntu2 |
gnutlsopenSUSE:Tumbleweed From an advisory covering 10 CVEs |
before 3.4.15-1.1 | 3.4.15-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-6251 is a medium vulnerability (CVSS 5.0) in Gnu Gnutls, published August 12, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 19.2%, the 97th percentile. Fixed in gnutls28 3.3.17-1.
References
bugzilla.redhat.com/show_bug.cgi?id=1251902
lists.opensuse.org/opensuse-updates/2015-09/msg00001.html
securitytracker.com/id/1033226
gnutls.org/security.html
openwall.com/lists/oss-security/2015/08/10/1
securityfocus.com/bid/76267
Show 28 moreShow less
lists.fedoraproject.org/pipermail/package-announce/2015-September/165286.html
gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12
debian.org/security/2015/dsa-3334
nvd.nist.gov/vuln/detail/CVE-2015-6251
github.com/advisories/GHSA-63p6-5792-gpfq
security-tracker.debian.org/tracker/CVE-2015-6251
advisories.mageia.org/MGASA-2015-0322.html
bugs.mageia.org/show_bug.cgi?id=15504
suse.com/support/update/announcement/2015/suse-su-20151518-1
bugzilla.suse.com/929414
ubuntu.com/security/CVE-2015-6251
cve.org/CVERecord?id=CVE-2015-6251