Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:02583-1

Опубликовано: 31 июл. 2025
Источник: suse-cvrf

Описание

Security update for gnutls

This update for gnutls fixes the following issues:

  • CVE-2025-6395: Fix NULL pointer dereference when 2nd Client Hello omits PSK (bsc#1246299)
  • CVE-2025-32988: Fix double-free due to incorrect ownership handling in the export logic of SAN entries containing an otherName (bsc#1246232)
  • CVE-2025-32990: Fix 1-byte heap buffer overflow when parsing templates with certtool (bsc#1246267)

Список пакетов

SUSE Enterprise Storage 7.1
gnutls-3.6.7-150200.14.37.1
libgnutls-devel-3.6.7-150200.14.37.1
libgnutls-devel-32bit-3.6.7-150200.14.37.1
libgnutls30-3.6.7-150200.14.37.1
libgnutls30-32bit-3.6.7-150200.14.37.1
libgnutls30-hmac-3.6.7-150200.14.37.1
libgnutls30-hmac-32bit-3.6.7-150200.14.37.1
libgnutlsxx-devel-3.6.7-150200.14.37.1
libgnutlsxx28-3.6.7-150200.14.37.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
gnutls-3.6.7-150200.14.37.1
libgnutls-devel-3.6.7-150200.14.37.1
libgnutls-devel-32bit-3.6.7-150200.14.37.1
libgnutls30-3.6.7-150200.14.37.1
libgnutls30-32bit-3.6.7-150200.14.37.1
libgnutls30-hmac-3.6.7-150200.14.37.1
libgnutls30-hmac-32bit-3.6.7-150200.14.37.1
libgnutlsxx-devel-3.6.7-150200.14.37.1
libgnutlsxx28-3.6.7-150200.14.37.1
SUSE Linux Enterprise Micro 5.1
libgnutls30-3.6.7-150200.14.37.1
libgnutls30-hmac-3.6.7-150200.14.37.1
SUSE Linux Enterprise Micro 5.2
gnutls-3.6.7-150200.14.37.1
libgnutls30-3.6.7-150200.14.37.1
libgnutls30-hmac-3.6.7-150200.14.37.1
SUSE Linux Enterprise Server 15 SP3-LTSS
gnutls-3.6.7-150200.14.37.1
libgnutls-devel-3.6.7-150200.14.37.1
libgnutls-devel-32bit-3.6.7-150200.14.37.1
libgnutls30-3.6.7-150200.14.37.1
libgnutls30-32bit-3.6.7-150200.14.37.1
libgnutls30-hmac-3.6.7-150200.14.37.1
libgnutls30-hmac-32bit-3.6.7-150200.14.37.1
libgnutlsxx-devel-3.6.7-150200.14.37.1
libgnutlsxx28-3.6.7-150200.14.37.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3
gnutls-3.6.7-150200.14.37.1
libgnutls-devel-3.6.7-150200.14.37.1
libgnutls-devel-32bit-3.6.7-150200.14.37.1
libgnutls30-3.6.7-150200.14.37.1
libgnutls30-32bit-3.6.7-150200.14.37.1
libgnutls30-hmac-3.6.7-150200.14.37.1
libgnutls30-hmac-32bit-3.6.7-150200.14.37.1
libgnutlsxx-devel-3.6.7-150200.14.37.1
libgnutlsxx28-3.6.7-150200.14.37.1

Ссылки

Описание

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.

Затронутые продукты
SUSE Enterprise Storage 7.1:gnutls-3.6.7-150200.14.37.1
SUSE Enterprise Storage 7.1:libgnutls-devel-3.6.7-150200.14.37.1
SUSE Enterprise Storage 7.1:libgnutls-devel-32bit-3.6.7-150200.14.37.1
SUSE Enterprise Storage 7.1:libgnutls30-3.6.7-150200.14.37.1
Ссылки

Описание

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.

Затронутые продукты
SUSE Enterprise Storage 7.1:gnutls-3.6.7-150200.14.37.1
SUSE Enterprise Storage 7.1:libgnutls-devel-3.6.7-150200.14.37.1
SUSE Enterprise Storage 7.1:libgnutls-devel-32bit-3.6.7-150200.14.37.1
SUSE Enterprise Storage 7.1:libgnutls30-3.6.7-150200.14.37.1
Ссылки

Описание

A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().

Затронутые продукты
SUSE Enterprise Storage 7.1:gnutls-3.6.7-150200.14.37.1
SUSE Enterprise Storage 7.1:libgnutls-devel-3.6.7-150200.14.37.1
SUSE Enterprise Storage 7.1:libgnutls-devel-32bit-3.6.7-150200.14.37.1
SUSE Enterprise Storage 7.1:libgnutls30-3.6.7-150200.14.37.1
Ссылки
Уязвимость SUSE-SU-2025:02583-1