Debian Security Advisory
DSA-2697-1 gnutls26 -- out-of-bounds array read
- Date Reported:
- 29 May 2013
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 709301.
In Mitre's CVE dictionary: CVE-2013-2116.
- More information:
It was discovered that a malicious client could crash a GNUTLS server and vice versa, by sending TLS records encrypted with a block cipher which contain invalid padding.
The oldstable distribution (squeeze) is not affected because the security fix that introduced this vulnerability was not applied to it.
For the stable distribution (wheezy), this problem has been fixed in version 2.12.20-7.
For the unstable distribution (sid), this problem has been fixed in version 2.12.23-5.
We recommend that you upgrade your gnutls26 packages.