CVE-2013-2116

Publication date 29 May 2013

Last updated 24 July 2024

Ubuntu priority

The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gnutls26	14.04 LTS trusty	Fixed 2.12.23-1ubuntu2
	13.10 saucy	Fixed 2.12.23-1ubuntu2
	13.04 raring	Fixed 2.12.23-1ubuntu1.1
	12.10 quantal	Fixed 2.12.14-5ubuntu4.3
	12.04 LTS precise	Fixed 2.12.14-5ubuntu3.4
	10.04 LTS lucid	Fixed 2.8.5-2ubuntu0.4
gnutls28	14.04 LTS trusty	Not in release
	13.10 saucy	Not affected
	13.04 raring	Ignored end of life
	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

Notes

mdeslaur

introduced by Lucky 13 fix, only on 2.x

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
gnutls26	Upstream: 5164d5a

References

Related Ubuntu Security Notices (USN)