Index: vuln.xml =================================================================== RCS file: /home/pcvs/ports/security/vuxml/vuln.xml,v retrieving revision 1.2010 diff -u -r1.2010 vuln.xml --- vuln.xml 17 Aug 2009 13:26:56 -0000 1.2010 +++ vuln.xml 17 Aug 2009 14:29:57 -0000 @@ -34,6 +34,86 @@ --> + + GnuTLS -- multiple vulnerabilities + + + gnutls + 2.6.6 + + + gnutls-devel + 2.7.8 + + + + +

SecurityFocus reports:

+
+

GnuTLS is prone to multiple remote vulnerabilities:

+
    +
  • A remote code-execution vulnerability.
    • +
  • A denial-of-service vulnerability.
    • +
  • A signature-generation vulnerability.
    • +
  • A signature-verification vulnerability.
    • +
+

An attacker can exploit these issues to potentially execute + arbitrary code, trigger denial-of-service conditions, carry + out attacks against data signed with weak signatures, and + cause clients to accept expired or invalid certificates from + servers.

+
+ + + + CVE-2009-1415 + CVE-2009-1416 + CVE-2009-1417 + 34783 + http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515 + http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516 + http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517 + + + 2009-05-21 + 2009-08-17 + + + + + GnuTLS -- improper SSL certificate verification + + + gnutls + 2.8.3 + + + gnutls-devel + 0 + + + + +

GnuTLS reports:

+
+

By using a NUL byte in CN/SAN fields, it was possible to fool + GnuTLS into 1) not printing the entire CN/SAN field value when + printing a certificate and 2) cause incorrect positive matches + when matching a hostname against a certificate.

+
+ + + + CVE-2009-2730 + http://article.gmane.org/gmane.network.gnutls.general/1733 + http://secunia.com/advisories/36266 + + + 2009-08-11 + 2009-08-17 + + + memcached -- memcached stats maps Information Disclosure Weakness