Flutterby™! : CVE-2014-3466 GnuTLS bug 2014-06-03 18:55:56.315751+02

CVE-2014-3466 GnuTLS bug

2014-06-03 18:55:56.315751+02 by Dan Lyke 0 comments

Fuuuu, they just keep coming: Critical new bug in crypto library leaves Linux, apps open to drive-by attacks: Vulnerability in GnuTLS allows malicious sites to execute malicious code.

The bug is CVE-2014-3466.

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.

Comment policy

We will not edit your comments. However, we may delete your comments, or cause them to be hidden behind another link, if we feel they detract from the conversation. Commercial plugs are fine, if they are relevant to the conversation, and if you don't try to pretend to be a consumer. Annoying endorsements will be deleted if you're lucky, if you're not a whole bunch of people smarter and more articulate than you will ridicule you, and we will leave such ridicule in place.

Flutterby™ is a trademark claimed by