{"id":"CVE-2014-3466","aliases":["DEBIAN-CVE-2014-3466","DLA-0001-1","DSA-2944-1","EUVD-2014-3478","GHSA-cc2g-hj2r-x228","MGASA-2014-0248","RHSA-2014:0594","RHSA-2014:0595","RHSA-2014:0684","RHSA-2014:0815","SUSE-SU-2015:0675-1","UBUNTU-CVE-2014-3466","USN-2229-1","openSUSE-SU-2024:10105-1"],"status":"published","title":"Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1...","description":"Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.11221,"percentile":0.95986,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119"],"published":"2014-06-01T00:00:00Z","modified":"2026-10-23T15:47:32Z","exploits":[{"source":"pocgithub","id":"azet/CVE-2014-3466_PoC","title":"azet/CVE-2014-3466_PoC","date":"2014-06-01","url":"https://github.com/azet/CVE-2014-3466_PoC"}],"fixes":[{"ecosystem":"Debian:12","package":"gnutls28","fixed_in":["3.2.15-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnutls28","fixed_in":["3.2.15-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnutls28","fixed_in":["3.2.15-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"gnutls26","fixed_in":["2.8.6-1+squeeze4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"gnutls26","fixed_in":["2.12.20-8+deb7u2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-debuginfo","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-utils","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-devel","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-guile","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-debuginfo","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-utils","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-devel","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-guile","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-debuginfo","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-devel","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-utils","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-guile","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-debuginfo","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-devel","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-utils","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-guile","fixed_in":["0:2.8.5-14.el6_5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"gnutls26","fixed_in":["2.12.23-12ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"gnutls28","fixed_in":["3.2.11-2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.6-1+squeeze4"}]}],"versions":["2.8.6-1","2.8.6-1+squeeze1","2.8.6-1+squeeze2","2.8.6-1+squeeze3"]},{"source":"osv","ecosystem":"Debian:7","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.20-8+deb7u2"}]}],"versions":["2.12.20-6","2.12.20-7","2.12.20-8","2.12.20-8+deb7u1"]},{"source":"osv","ecosystem":"Mageia:3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.16-1.3.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1.3.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-16.el5_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-14.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.18-9.el7_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::hypervisor","package":"rhev-hypervisor6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.5-20140624.0.el6ev"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.23-12ubuntu2.1"}]}],"versions":["2.12.23-1ubuntu4","2.12.23-1ubuntu5","2.12.23-12ubuntu1","2.12.23-12ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.11-2ubuntu1.1"}]}],"versions":["3.2.3-1ubuntu1","3.2.3-1ubuntu2","3.2.11-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.23-12ubuntu2.1"}]}],"versions":["2.12.23-1ubuntu4","2.12.23-1ubuntu5","2.12.23-12ubuntu1","2.12.23-12ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.15-1.1"}]}],"bundled":10}],"products":[{"vendor":"gnu","product":"gnutls"}],"references":[{"url":"http://www.gnutls.org/security.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21678776","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-2944","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/58340","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0595.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2229-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/58642","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/67741","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.novell.com/support/kb/doc.php?id=7015302","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/59057","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://linux.oracle.com/errata/ELSA-2014-0595.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/59086","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1101932","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0684.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00007.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/59021","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0815.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://radare.today/technical-analysis-of-the-gnutls-hello-vulnerability/","tags":["x_refsource_MISC","x_transferred","Exploit","URL Repurposed","evidence","web"]},{"url":"http://www.novell.com/support/kb/doc.php?id=7015303","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://linux.oracle.com/errata/ELSA-2014-0594.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/58598","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096155","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/59838","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/60384","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0594.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59016","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00010.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/58601","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59408","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://www.gitorious.org/gnutls/gnutls/commit/688ea6428a432c39203d00acd1af0e7684e5ddfd","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://www.securitytracker.com/id/1030314","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3466","tags":["advisory"]},{"url":"http://radare.today/technical-analysis-of-the-gnutls-hello-vulnerability"},{"url":"https://github.com/advisories/GHSA-cc2g-hj2r-x228"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3466","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0248.html","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3465","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3466","tags":["advisory"]},{"url":"http://www.gnutls.org/security.html#GNUTLS-SA-2014-3","tags":["web","report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13457","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0594","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1102329","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0594.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3466","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3466","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3467","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3467","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3468","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3468","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3468","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3469","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3469","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0595","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0595.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0684","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1101734","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0684.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3465","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3465","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3465","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0815","tags":["advisory"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1107789","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0815.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150675-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/821818","tags":["report"]},{"url":"https://bugzilla.suse.com/835760","tags":["report"]},{"url":"https://bugzilla.suse.com/865804","tags":["report"]},{"url":"https://bugzilla.suse.com/865993","tags":["report"]},{"url":"https://bugzilla.suse.com/880730","tags":["report"]},{"url":"https://bugzilla.suse.com/880910","tags":["report"]},{"url":"https://bugzilla.suse.com/919938","tags":["report"]},{"url":"https://bugzilla.suse.com/921684","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2009-5138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0294","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-3466","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2229-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6251","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3466","description":"Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.","status":"published","published":"2014-06-03T14:00:00Z","modified":"2024-08-06T10:43:06.197Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-3478","description":"Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.","status":"published","published":"2014-06-03T14:00:00Z","modified":"2024-08-06T10:43:06Z","updated_at":"2026-11-03T01:57:10.864648Z"}],"ghsa":[{"id":"GHSA-cc2g-hj2r-x228","title":"Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1...","description":"Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.","status":"published","published":"2022-05-14T04:01:59Z","modified":"2025-04-12T12:35:30Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:17.900782Z"}],"nvd":[{"id":"CVE-2014-3466","description":"Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.","status":"published","published":"2014-06-03T14:55:10.257Z","modified":"2026-06-17T00:08:13.853Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:54.464139Z"}],"osv":[{"id":"CVE-2014-3466","description":"Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.","status":"published","published":"2014-06-03T14:55:10Z","modified":"2026-04-16T06:17:18.842778799Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3466","description":"Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.","status":"published","published":"2014-06-03T14:55:10.257Z","modified":"2026-10-23T15:47:32.870846362Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-0001-1","title":"gnutls26 - security update","status":"published","published":"2014-06-02T00:00:00Z","modified":"2026-03-09T01:01:35.69546Z","updated_at":"2026-11-02T15:46:08.746073Z"},{"id":"DSA-2944-1","title":"gnutls26 - security update","status":"published","published":"2014-06-01T00:00:00Z","modified":"2026-03-09T01:21:42.048083Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0248","title":"Updated gnutls packages fix CVE-2104-3465-6","description":"Updated gnutls packages fix security vulnerabilities:\n\nA NULL pointer dereference flaw was discovered in GnuTLS's\ngnutls_x509_dn_oid_name().  The function, when called with the\nGNUTLS_X509_DN_OID_RETURN_OID flag, should not return NULL to its caller.\nHowever, it could previously return NULL when parsed X.509 certificates\nincluded specific OIDs (CVE-2014-3465).\n\nA flaw was found in the way GnuTLS parsed session ids from Server Hello\npackets of the TLS/SSL handshake.  A malicious server could use this flaw to\nsend an excessively long session id value and trigger a buffer overflow in a\nconnecting TLS/SSL client using GnuTLS, causing it to crash or, possibly,\nexecute arbitrary code (CVE-2014-3466).\n","status":"published","published":"2014-06-02T18:47:21Z","modified":"2026-04-16T06:25:06.440549886Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10105-1","title":"gnutls-3.4.15-1.1 on GA media","description":"These are all security issues fixed in the gnutls-3.4.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:28.673202Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:0594","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-13T08:52:54Z","modified":"2026-06-28T10:10:17Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0595","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-13T08:52:43Z","modified":"2026-06-28T10:10:18Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0684","title":"Red Hat Security Advisory: gnutls security update","status":"published","published":"2024-09-15T21:45:08Z","modified":"2026-06-28T10:10:24Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:0815","title":"Red Hat Security Advisory: rhev-hypervisor6 security update","status":"published","published":"2024-09-13T08:54:18Z","modified":"2026-06-28T10:10:38Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:0675-1","title":"Security update for gnutls","description":"\nGnuTLS has been patched to ensure proper parsing of session ids during the \nTLS/SSL handshake. Additionally, three issues inherited from libtasn1 have \nbeen fixed.\n\nFurther information is available at \nhttp://www.gnutls.org/security.html#GNUTLS-SA-2014-3\n\u003chttp://www.gnutls.org/security.html#GNUTLS-SA-2014-3\u003e\n\nThese security issues have been fixed:\n\n    * Possible memory corruption during connect (CVE-2014-3466)\n    * Multiple boundary check issues could allow DoS (CVE-2014-3467)\n    * asn1_get_bit_der() can return negative bit length (CVE-2014-3468)\n    * Possible DoS by NULL pointer dereference (CVE-2014-3469)\n\nSecurity Issue references:\n\n    * CVE-2014-3466\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466\u003e\n\n","status":"published","published":"2014-06-03T20:02:07Z","modified":"2026-02-04T02:21:56.022429Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2014-3466","description":"Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.","status":"published","published":"2014-06-01T00:00:00Z","modified":"2026-04-22T09:38:25.57479Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2229-1","title":"gnutls26 vulnerability","description":"Joonas Kuorilehto discovered that GnuTLS incorrectly handled Server Hello\nmessages. A malicious remote server or a machine-in-the-middle could use this\nissue to cause GnuTLS to crash, resulting in a denial of service, or\npossibly execute arbitrary code.\n","status":"published","published":"2014-06-02T13:17:23Z","modified":"2026-04-22T08:53:16.36175Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}