lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 13 May 2005 11:46:50 +0200
From: Martin Pitt <>
Subject: [USN-126-1] GNU TLS library vulnerability

Ubuntu Security Notice USN-126-1	       May 13, 2005
gnutls11, gnutls10 vulnerability

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)

The following packages are affected:


The problem can be corrected by upgrading the affected package to
version 1.0.4-3ubuntu1.1 (for Ubuntu 4.10), or 1.0.16-13ubuntu0.1 (for
Ubuntu 5.04).  For most desktop applications, a standard system
upgrade is sufficient to effect the necessary changes. However, if you
are using server and long running applications that use libgnutls
(cupsys, exim4, Gaim), you must restart them manually. If you can
afford to reboot your machine, this is the easiest way to ensure that
all services using this library are restarted correctly.

Details follow:

A Denial of Service vulnerability was discovered in the GNU TLS
library, which provides common cryptographic algorithms and is used by
many applications in Ubuntu. Due to a missing sanity check of the
padding length field, specially crafted ciphertext blocks caused an
out of bounds memory access which could crash the application. It was
not possible to exploit this to execute any attacker specified code.

Updated packages for Ubuntu 4.10 (Warty Warthog):

  Source archives:
      Size/MD5:    49877 a421703ee46eaba0ac70a6d892069139
      Size/MD5:      863 831a452e9369be66097d520579a66354
      Size/MD5:  1378290 565d2835b772008689476488265f4e99

  Architecture independent packages:
      Size/MD5:   553460 77af9be62e963e2771ff3ce9259dd086

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)
      Size/MD5:   193656 11b33a8fff25292ac2ae1b680de3c006
      Size/MD5:   367136 a5a4b023309977a4ac05abaf400ef65a
      Size/MD5:   309288 9030fd065858abe487993fff229d9c61

  i386 architecture (x86 compatible Intel/AMD)
      Size/MD5:   185176 6e27b1181c07ec15991bf30b227d559f
      Size/MD5:   328650 9a3ef7584be77d7d6dbd136032f55e89
      Size/MD5:   279368 3f8c3b8ed3b96649c2a973846bc824f0

  powerpc architecture (Apple Macintosh G3/G4/G5)
      Size/MD5:   195926 f0f90f8b4c004a70019a7188c78a2ffc
      Size/MD5:   396076 88fba2e88301873bb674e34a398a1af4
      Size/MD5:   284662 71c918cd7d3b1e445ac43be2705c1723

Updated packages for Ubuntu 5.04 (Hoary Hedgehog):

  Source archives:
      Size/MD5:   337831 08f61cd8a964751d06c208237985ac7b
      Size/MD5:      814 40bd2f5530ed7d27f5f6c8dcce325a4a
      Size/MD5:  1504638 7b410fa3c563c7988e434a8c8671b3cd

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)
      Size/MD5:   217154 74e29f9aa85a515c7cf387a9a77ad901
      Size/MD5:   574984 9a68ba7e194b594265e48c81cea0c5d6
      Size/MD5:   392034 bbbe41cdaac3a4402124be97b0b905f5
      Size/MD5:   326610 4b973b460ab26e7c61fe66c99e745c37

  i386 architecture (x86 compatible Intel/AMD)
      Size/MD5:   203144 9997faa5bbfc8f2181856ad51d4fb82a
      Size/MD5:   554796 e0730689824c59ccdc5285c1ec801043
      Size/MD5:   356846 fb313893aa729272b5e12a8c9b0da5db
      Size/MD5:   293072 aa53297d5112cb6d40805256b1427384

  ia64 architecture (Intel Itanium)
      Size/MD5:   258640 5eb86c32dbc2181ba54f2522e6fa2f5b
      Size/MD5:   585292 db08a7b1ac9e5b9e1ab2bf964d18162c
      Size/MD5:   521564 827ea4039e5b2b1e06e0c4c27ff7bc16
      Size/MD5:   384526 45bd4f99407f7cae773b4c7302927df4

  powerpc architecture (Apple Macintosh G3/G4/G5)
      Size/MD5:   218072 6c76d07dc561da7a749a3bf72a4f14a3
      Size/MD5:  1417598 470ec82e16a7937bf2cb66586181cae0
      Size/MD5:   388428 0f628a18a2f3c4b01bc7ac1da8e9fd5e
      Size/MD5:   299128 8810c5d0fe0c2b3780f2ce9d0a1058e1

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists