GCVE - cpe:2.3:a:gnu:gnutls:2.3.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gnu:gnutls:2.3.5:*:*:*:*:*:*:*

part: a version: 2.3.5 update: *

Vendor	Gnu (`575dd98a-a14a-5d9e-a2eb-97d38d86fcb9`)
Product	Gnutls (`955d43fd-13b7-57ed-9845-207af9eef570`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/gnutls/gnutls`	purl2cpe	2026-06-01 10:11:56.107265
`pkg:gitlab/gnutls/gnutls`	purl2cpe	2026-06-01 10:11:56.107266
`pkg:gnu/gnutls`	purl2cpe	2026-06-01 10:11:56.107268
`pkg:rpm/fedora/gnutls`	purl2cpe	2026-06-01 10:11:56.107269
`pkg:rpm/opensuse/gnutls`	purl2cpe	2026-06-01 10:11:56.107270

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-1619`	vulnerable	2026-06-08 05:03:54.977061	Details available The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. Published: 2013-02-08T19:00:00.000Z Updated: 2024-08-06T15:04:49.607Z Open on db.gcve.eu Reference links http://secunia.com/advisories/57260 https://gitorious.org/gnutls/gnutls/commit/328ee22c1b3951e060c7124c7cb1cee592c59bc0 http://www.gnutls.org/security.html#GNUTLS-SA-2013-1 http://www.isg.rhul.ac.uk/tls/TLStiming.pdf http://secunia.com/advisories/57274	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1663`	vulnerable	2026-06-08 05:00:50.230039	Details available Double free vulnerability in libgnutls in GnuTLS before 3.0.14 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted certificate list. Published: 2012-03-13T22:00:00.000Z Updated: 2024-08-06T19:01:02.915Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/74099 http://www.exploit-db.com/exploits/24865 http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5866	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1573`	vulnerable	2026-06-08 05:00:49.534014	Details available gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure. Published: 2012-03-26T19:00:00.000Z Updated: 2024-08-06T19:01:01.946Z Open on db.gcve.eu Reference links http://www.ubuntu.com/usn/USN-1418-1 http://secunia.com/advisories/57260 http://rhn.redhat.com/errata/RHSA-2012-0531.html http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912 http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=b495740f2ff66550ca9395b3fda3ea32c3acb185	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1569`	vulnerable	2026-06-08 05:00:49.484596	Details available The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure. Published: 2012-03-26T19:00:00.000Z Updated: 2024-08-06T19:01:02.196Z Open on db.gcve.eu Reference links http://secunia.com/advisories/57260 http://rhn.redhat.com/errata/RHSA-2012-0427.html http://secunia.com/advisories/48578 http://rhn.redhat.com/errata/RHSA-2012-0531.html http://secunia.com/advisories/49002	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-2730`	vulnerable	2026-06-08 04:51:30.243819	Details available libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Published: 2009-08-12T10:00:00.000Z Updated: 2024-08-07T05:59:57.016Z Open on db.gcve.eu Reference links https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8409 http://www.securitytracker.com/id?1022777 http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://www.openwall.com/lists/oss-security/2009/08/14/6 http://www.redhat.com/support/errata/RHSA-2009-1232.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-2409`	vulnerable	2026-06-08 04:51:28.269385	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-1417`	vulnerable	2026-06-08 04:51:22.881071	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-2377`	vulnerable	2026-06-08 04:50:23.737829	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-1950`	vulnerable	2026-06-08 04:50:22.468330	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-1949`	vulnerable	2026-06-08 04:50:22.465119	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-1948`	vulnerable	2026-06-08 04:50:22.458896	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.