{"id":"CVE-2017-5337","aliases":["DEBIAN-CVE-2017-5337","EUVD-2017-14442","GHSA-c5c3-3h6m-3ghx","MGASA-2017-0053","RHSA-2017:0574","RHSA-2017:2292","SUSE-SU-2017:0304-1","SUSE-SU-2017:0348-1","UBUNTU-CVE-2017-5337","USN-3183-1"],"status":"published","title":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3...","description":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06179,"percentile":0.93539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-01-11T00:00:00Z","modified":"2026-10-24T14:03:26Z","fixes":[{"ecosystem":"Debian:12","package":"gnutls28","fixed_in":["3.5.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnutls28","fixed_in":["3.5.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnutls28","fixed_in":["3.5.8-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"gnutls26","fixed_in":["2.12.23-12ubuntu2.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"gnutls28","fixed_in":["3.4.10-4ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.8-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.21-1.3.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-guile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12.23-21.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls-c++","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls-dane","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gnutls-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.26-9.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.67.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 11 SP4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.67.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.67.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-24.39.67.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"gnutls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.15-16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.23-12ubuntu2.6"}]}],"versions":["2.12.23-1ubuntu4","2.12.23-1ubuntu5","2.12.23-12ubuntu1","2.12.23-12ubuntu2","2.12.23-12ubuntu2.1","2.12.23-12ubuntu2.2","2.12.23-12ubuntu2.3","2.12.23-12ubuntu2.4","2.12.23-12ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.2"}]}],"versions":["3.3.15-5ubuntu2","3.3.18-1ubuntu1","3.3.20-1ubuntu1","3.4.9-2ubuntu1","3.4.10-4ubuntu1","3.4.10-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gnutls26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.23-12ubuntu2.6"}]}],"versions":["2.12.23-1ubuntu4","2.12.23-1ubuntu5","2.12.23-12ubuntu1","2.12.23-12ubuntu2","2.12.23-12ubuntu2.1","2.12.23-12ubuntu2.2","2.12.23-12ubuntu2.3","2.12.23-12ubuntu2.4","2.12.23-12ubuntu2.5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gnutls28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.10-4ubuntu1.2"}]}],"versions":["3.3.15-5ubuntu2","3.3.18-1ubuntu1","3.3.20-1ubuntu1","3.4.9-2ubuntu1","3.4.10-4ubuntu1","3.4.10-4ubuntu1.1"],"bundled":6}],"products":[{"vendor":"gnu","product":"gnutls"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2017/01/10/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2292","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1037576","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/11/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/95372","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0574.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201702-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Patch","Third Party Advisory","Vendor Advisory","fix"]},{"url":"https://gnutls.org/security.html#GNUTLS-SA-2017-2","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://gitlab.com/gnutls/gnutls/commit/94fcf1645ea17223237aaf8d19132e004afddc1a","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=338","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=346","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5337","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c5c3-3h6m-3ghx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-5337","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0053.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20099","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-security-announce/2017-01/msg00063.html","tags":["web"]},{"url":"http://www.gnutls.org/security.html","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2017/01/11/4","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0574","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Release_Notes/index.html","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Technical_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1320982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1321112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1323215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1326073","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1326389","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1326886","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1327656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1328205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1333521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1335924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1337460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1384743","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1411836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1412235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1412236","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1415682","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0574.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8610","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8610","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8610","tags":["advisory"]},{"url":"http://security.360.cn/cve/CVE-2016-8610","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5335","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5335","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5336","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5336","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5337","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5337","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1335931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375463","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1378373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1379283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1379739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1380642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1383748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1388932","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1399232","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1411835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1443033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1454621","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2292.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7444","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7444","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7444","tags":["advisory"]},{"url":"https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html","tags":["article"]},{"url":"https://www.gnutls.org/security.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5334","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5334","tags":["advisory"]},{"url":"https://gnutls.org/security.html#GNUTLS-SA-2017-1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7507","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7507","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7507","tags":["advisory"]},{"url":"https://www.gnutls.org/security.html#GNUTLS-SA-2017-4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7869","tags":["advisory"]},{"url":"https://www.gnutls.org/security.html#GNUTLS-SA-2017-3","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170304-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1005879","tags":["report"]},{"url":"https://bugzilla.suse.com/1018832","tags":["report"]},{"url":"https://bugzilla.suse.com/961491","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5337","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170348-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/999646","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7444","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-5337","tags":["report"]},{"url":"http://seclists.org/oss-sec/2017/q1/51","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3183-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7444","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8610","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5336","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-5337","description":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.","status":"published","published":"2017-03-24T15:00:00Z","modified":"2024-08-05T14:55:35.701Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-14442","description":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.","status":"published","published":"2017-03-24T15:00:00Z","modified":"2024-08-05T14:55:35Z","updated_at":"2026-11-03T02:39:16.415448Z"}],"ghsa":[{"id":"GHSA-c5c3-3h6m-3ghx","title":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3...","description":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.","status":"published","published":"2022-05-14T02:11:47Z","modified":"2023-02-02T05:05:06Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:01.503631Z"}],"nvd":[{"id":"CVE-2017-5337","description":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.","status":"published","published":"2017-03-24T15:59:00.92Z","modified":"2026-06-17T01:20:17.677Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:44.275273Z"}],"osv":[{"id":"CVE-2017-5337","description":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.","status":"published","published":"2017-03-24T15:59:00.92Z","modified":"2026-10-24T14:03:26.785460458Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"DEBIAN-CVE-2017-5337","description":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.","status":"published","published":"2017-03-24T15:59:00.92Z","modified":"2026-09-01T20:03:48.079408827Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"RHSA-2017:0574","title":"Red Hat Security Advisory: gnutls security, bug fix, and enhancement update","status":"published","published":"2024-09-15T23:40:52Z","modified":"2026-09-21T10:01:37Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:2292","title":"Red Hat Security Advisory: gnutls security, bug fix, and enhancement update","status":"published","published":"2024-09-15T23:57:46Z","modified":"2026-06-26T12:22:01.07526971Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-5337","description":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.","status":"published","published":"2017-01-11T00:00:00Z","modified":"2026-04-22T11:26:15.430169Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"MGASA-2017-0053","title":"Updated gnutls packages fix security vulnerability","description":"Remote denial of service in SSL alert handling. (CVE-2016-8610)\n\nIn gnutls_x509_ext_import_proxy: if the language was set but the policy\nwasn't, that could lead to a double free. (CVE-2017-5334)\n\nDecoding a specially crafted OpenPGP certificate could have lead to heap\nand stack overflows. (CVE-2017-5335, CVE-2017-5336 and CVE-2017-5337)\n","status":"published","published":"2017-02-20T13:00:19Z","modified":"2026-04-16T06:23:49.251215179Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2017:0304-1","title":"Security update for gnutls","description":"\nThis update for gnutls fixes the following issues:\n\n- Malformed asn1 definitions could cause a segmentation fault in the asn1 definition parser (bsc#961491).\n- CVE-2016-8610: Remote denial of service in SSL alert handling (bsc#1005879).\n- CVE-2017-5335: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832).\n- CVE-2017-5336: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832).\n- CVE-2017-5337: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832).\n","status":"published","published":"2017-01-27T17:23:55Z","modified":"2026-02-04T02:23:14.42222Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0348-1","title":"Security update for gnutls","description":"\nThis update for gnutls fixes the following security issues:\n\n- GnuTLS could have crashed when processing maliciously crafted OpenPGP\n  certificates (GNUTLS-SA-2017-2, bsc#1018832, CVE-2017-5335, CVE-2017-5337,\n  CVE-2017-5336)\n- GnuTLS could have falsely accepted certificates when using OCSP\n  (GNUTLS-SA-2016-3, bsc#999646, CVE-2016-7444)\n- GnuTLS could have suffered from 100% CPU load DoS attacks by using SSL alert\n  packets during the handshake (bsc#1005879, CVE-2016-8610)\n","status":"published","published":"2017-02-01T07:19:39Z","modified":"2026-02-04T04:02:51.62087Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3183-1","title":"gnutls26, gnutls28 vulnerabilities","description":"Stefan Buehler discovered that GnuTLS incorrectly verified the serial\nlength of OCSP responses. A remote attacker could possibly use this issue\nto bypass certain certificate validation measures. This issue only applied\nto Ubuntu 16.04 LTS. (CVE-2016-7444)\n\nShi Lei discovered that GnuTLS incorrectly handled certain warning alerts.\nA remote attacker could possibly use this issue to cause GnuTLS to hang,\nresulting in a denial of service. This issue has only been addressed in\nUbuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8610)\n\nIt was discovered that GnuTLS incorrectly decoded X.509 certificates with a\nProxy Certificate Information extension. A remote attacker could use this\nissue to cause GnuTLS to crash, resulting in a denial of service, or\npossibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS\nand Ubuntu 16.10. (CVE-2017-5334)\n\nIt was discovered that GnuTLS incorrectly handled certain OpenPGP\ncertificates. A remote attacker could possibly use this issue to cause\nGnuTLS to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337)\n","status":"published","published":"2017-02-01T17:56:17Z","modified":"2026-04-22T09:32:10.960296Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}