CVE-2014-8564

Name of the Vulnerable Software and Affected Versions GnuTLS versions 3.1.x through 3.1.27 GnuTLS versions 3.2.x through 3.2.19 GnuTLS versions 3.3.x through 3.3.9

Description The issue allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted Elliptic Curve Cryptography (ECC) certificate or certificate signing requests (CSR), related to generating key IDs. Exploitation of this issue may lead to disruption of confidentiality, integrity, and availability of protected information and can be carried out remotely.

Recommendations For GnuTLS versions 3.1.x through 3.1.27, update to version 3.1.28 or later. For GnuTLS versions 3.2.x through 3.2.19, update to version 3.2.20 or later. For GnuTLS versions 3.3.x through 3.3.9, update to version 3.3.10 or later.