[security-announce] GnuTLS: Security Update

Sona Sarmadi sona.sarmadi at enea.com
Tue Jan 26 09:46:39 CET 2016


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

	Enea Linux Security Advisory

=========================================================
Product/package: openssh
Severity: Medium
CVE Name: CVE-2015-6251
Layer: poky
=========================================================

This security update fixes double free flaw in certificate DN decoding.

Description:
Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before
3.4.4 allows remote attackers to cause a denial of service via a long
DistinguishedName (DN) entry in a certificate.

References:
http://www.gnutls.org/security.html#GNUTLS-SA-2015-3
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-6251
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6251

Upstream patch:
https://gitlab.com/gnutls/gnutls/commit/
272854367efc130fbd4f1a51840d80c630214e12

Correction for Enea Linux 5.0:
http://git.enea.com/cgit/linux/poky.git/patch/?id=7273dba2c5f6c834560cd8
4853a1df358221b469

How to get the latest patches
=============================
- - If you have already cloned meta-enea, update it to get new
security patches.

cd Enea-Linux-5.0/poky
git pull

- - If you have not yet cloned needed repositories, do it as described
below. (All patches are fetched implicitly when cloning the repos).

mkdir Enea-Linux-5.0
git -C Enea-Linux-5.0 clone -b dizzy git://git.enea.com/linux/poky.git
POKY=Enea-Linux-5.0/poky
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-enea.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-fsl-ppc.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-
hierofalcon.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-linaro.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-
openembedded.git
git -C $POKY clone -b dizzy
git://git.enea.com/linux/meta-virtualization.git
git -C $POKY/meta-enea clone -b dizzy
git://git.enea.com/linux/meta-enea/meta-vt.git


If you have any questions regarding the security patches and security
updates please contact security at enea.com.


Enea Security Team
Sona Sarmadi
Mobile: +46 70 971 4475
www.enea.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJWpzJvAAoJEAilI68fskZdo0UH+gNhrAcRF8l6IQw+ZXy/uwSK
WM5T2GAaegu9mJbANdyALarGy0SDun5W4XjIkPahpnqrtMyK0ZenDeze0TfnRU9g
BfkZUNHNmRLWuKPu+mbVFhuIDhHjGAFbAuT9qAvDzA3PL/ebrWHAgr7HBuqlz+7j
Iv1QXDvrFi488KuWXgMcUE+rTArbzOflguWV8Nv6YRwpNpTwkIok5DQVYCe1jClo
h1DRak628Uf1ODj3ouhy+YrpaKJglhUvB0cZQuHVoZRahyVPVPV/iIyQttk+kzhC
eq6ToaVXWq6zk2wk9gQKxTh0FwXCZWT2xFn6Ts/EXNxl7NpkgZh3w1SKA2CZegw=
=hzL1
-----END PGP SIGNATURE-----



More information about the security-announce mailing list