{"id":"CVE-2015-8313","aliases":["DEBIAN-CVE-2015-8313","DLA-364-1","DSA-3408-1","EUVD-2015-8199","GHSA-p72h-2892-8mjc","SUSE-SU-2016:0077-1","UBUNTU-CVE-2015-8313"],"status":"published","title":"GnuTLS incorrectly validates the first byte of padding in CBC modes","description":"GnuTLS incorrectly validates the first byte of padding in CBC modes","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01685,"percentile":0.77144,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203"],"published":"2015-11-30T00:00:00Z","modified":"2026-06-17T00:34:17Z","fixes":[{"ecosystem":"Debian:6.0","package":"gnutls26","fixed_in":["2.8.6-1+squeeze6"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"gnutls26","fixed_in":["2.12.20-8+deb7u4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"gnutls26","fixed_in":["2.12.23-12ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.6-1+squeeze6"}]}],"versions":["2.8.6-1","2.8.6-1+squeeze1","2.8.6-1+squeeze2","2.8.6-1+squeeze3","2.8.6-1+squeeze4","2.8.6-1+squeeze5"]},{"source":"osv","ecosystem":"Debian:7","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.20-8+deb7u4"}]}],"versions":["2.12.20-6","2.12.20-7","2.12.20-8","2.12.20-8+deb7u1","2.12.20-8+deb7u2","2.12.20-8+deb7u3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.60.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.60.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.60.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.60.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 11 SP3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.60.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 11 SP4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.60.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.60.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.60.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.60.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.60.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.60.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.23-12ubuntu2.3"}]}],"versions":["2.12.23-1ubuntu4","2.12.23-1ubuntu5","2.12.23-12ubuntu1","2.12.23-12ubuntu2","2.12.23-12ubuntu2.1","2.12.23-12ubuntu2.2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gnu","product":"gnutls"}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8313","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-8313","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2015-8313","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/78327","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.debian.org/security/2015/dsa-3408","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/archive/1/537012/100/0/threaded","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://blog.hboeck.de/archives/877-A-little-POODLE-left-in-GnuTLS-old-versions.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8313"},{"url":"https://github.com/advisories/GHSA-p72h-2892-8mjc"},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160077-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/924828","tags":["report"]},{"url":"https://bugzilla.suse.com/947271","tags":["report"]},{"url":"https://bugzilla.suse.com/957568","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8313","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-8313","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2821-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8313","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8313","description":"GnuTLS incorrectly validates the first byte of padding in CBC modes","status":"published","published":"2019-12-20T13:10:23Z","modified":"2024-08-06T08:13:32.09Z","updated_at":"2026-11-02T14:35:41.26549Z"}],"euvd":[{"id":"EUVD-2015-8199","description":"GnuTLS incorrectly validates the first byte of padding in CBC modes","status":"published","published":"2019-12-20T13:10:23Z","modified":"2024-08-06T08:13:32Z","updated_at":"2026-11-03T01:57:27.742981Z"}],"ghsa":[{"id":"GHSA-p72h-2892-8mjc","title":"GnuTLS incorrectly validates the first byte of padding in CBC modes","description":"GnuTLS incorrectly validates the first byte of padding in CBC modes","status":"published","published":"2022-05-24T17:04:48Z","modified":"2024-04-04T02:44:42Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:56:11.559223Z"}],"nvd":[{"id":"CVE-2015-8313","description":"GnuTLS incorrectly validates the first byte of padding in CBC modes","status":"published","published":"2019-12-20T14:15:11.523Z","modified":"2026-06-17T00:34:17.923Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:03:19.73542Z"}],"osv":[{"id":"UBUNTU-CVE-2015-8313","description":"GnuTLS incorrectly validates the first byte of padding in CBC modes","status":"published","published":"2015-11-30T00:00:00Z","modified":"2026-04-22T10:20:21.043693Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"DLA-364-1","title":"gnutls26 - security update","status":"published","published":"2015-12-08T00:00:00Z","modified":"2026-03-09T01:17:54.753867Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-3408-1","title":"gnutls26 - security update","status":"published","published":"2015-12-01T00:00:00Z","modified":"2026-03-09T01:18:54.501051Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"SUSE-SU-2016:0077-1","title":"Security update for gnutls","description":"\nThis update for gnutls fixes the following security issues:\n\n- CVE-2015-8313: First byte of the padding in CBC mode is not checked (bsc#957568)\n- CVE-2015-2806: Two-byte stack overflow in asn1_der_decoding (bsc#924828)\n","status":"published","published":"2016-01-11T15:41:07Z","modified":"2026-02-04T04:06:23.350131Z","updated_at":"2026-11-02T15:53:43.030986Z"}]}}