CVE-2017-5334
Critical · 9.8CVSS
9.8
EPSS
32.8%
Published
Mar 24, 2017
CISA due date
—
The record
Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | gnutls28 | 0 | 3.5.8-1 |
| Debian:12 | gnutls28 | 0 | 3.5.8-1 |
| Debian:13 | gnutls28 | 0 | 3.5.8-1 |
| Mageia:5 | gnutls | 0 | 3.2.21-1.3.mga5 |
| Red Hat:enterprise_linux:7::client | gnutls | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::client | gnutls-c++ | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::client | gnutls-dane | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::client | gnutls-debuginfo | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::client | gnutls-devel | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::client | gnutls-utils | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::computenode | gnutls | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::computenode | gnutls-c++ | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::computenode | gnutls-dane | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::computenode | gnutls-debuginfo | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::computenode | gnutls-devel | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::computenode | gnutls-utils | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::server | gnutls | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::server | gnutls-c++ | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::server | gnutls-dane | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::server | gnutls-debuginfo | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::server | gnutls-devel | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::server | gnutls-utils | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::workstation | gnutls | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::workstation | gnutls-c++ | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::workstation | gnutls-dane | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::workstation | gnutls-debuginfo | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::workstation | gnutls-devel | 0 | 0:3.3.26-9.el7 |
| Red Hat:enterprise_linux:7::workstation | gnutls-utils | 0 | 0:3.3.26-9.el7 |
| Ubuntu:14.04:LTS | gnutls26 | 0 | 2.12.23-12ubuntu2.6 |
| Ubuntu:16.04:LTS | gnutls28 | 0 | 3.4.10-4ubuntu1.2 |
Related vulnerabilities
- CVE-2024-28834 A flaw was found in GnuTLS. Also affects gnutls28
- CVE-2024-28835 A flaw has been discovered in GnuTLS where an application crash can be induced when… Also affects gnutls28
- CVE-2024-0553 A vulnerability was found in GnuTLS. Also affects gnutls28
- CVE-2023-5981 A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK… Also affects gnutls28
- CVE-2017-7507 GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while… Also affects gnutls28
- CVE-2016-7444 The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and… Also affects gnutls28
- CVE-2015-7575 Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before… Also affects gnutls28
- CVE-2015-6251 Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote… Also affects gnutls28