[Technik] [SECURITY] [DSA 1581-1] New gnutls13 packages fix potential code execution

[Noèl Köthe]

Am Dienstag, den 20.05.2008, 18:37 +0200 schrieb Florian Weimer:

> Debian Security Advisory DSA-1581-1                  security at debian.org
> http://www.debian.org/security/                           Florian Weimer
> May 20, 2008                          http://www.debian.org/security/faq
> 
> Package        : gnutls13
> Vulnerability  : several
> Problem type   : remote
> Debian-specific: no
> CVE Id(s)      : CVE-2008-1948, CVE-2008-1949, CVE-2008-1950

gnutls 13 auf allen Rechnern aktualisiert.

> For the stable distribution (etch), these problems have been fixed in
> version 1.4.4-3+etch1.  (Builds for the arm architecture are currently
> not available and will be released later.)

changelog:
gnutls13 (1.4.4-3+etch1) stable-security; urgency=high

  * Apply patch from Simon Josefsson to fix three security vulnerabilities
    (GNUTLS-SA-2008-1):
    - Fix crash when sending invalid server name (GNUTLS-SA-2008-1-1)
    - Fix crash when sending repeated client hellos (GNUTLS-SA-2008-1-2)
    - Fix crash in cipher padding decoding for invalid record lengths
      (GNUTLS-SA-2008-1-3)

 -- Florian Weimer <fw at deneb.enyo.de>  Tue, 20 May 2008 09:57:16 +0200

-- 
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Dies ist ein digital signierter Nachrichtenteil
Url : /archiv/technik/attachments/20080522/d043a12f/attachment-0001.pgp