CVE-2008-1950

Publication date 21 May 2008

Last updated 24 July 2024

Ubuntu priority

Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
gnutls12	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Not in release
	6.06 LTS dapper	Fixed 1.2.9-2ubuntu1.2
gnutls13	8.04 LTS hardy	Fixed 2.0.4-1ubuntu2.1
	7.10 gutsy	Fixed 1.6.3-1ubuntu0.1
	7.04 feisty	Fixed 1.4.4-3ubuntu0.1
	6.06 LTS dapper	Not in release
gnutls26	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Not in release
	6.06 LTS dapper	Not in release

CVE-2008-1950

Status

References

Related Ubuntu Security Notices (USN)

Other references