lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.

Threat-Mapped Scoring

Score: 1.5

Priority: P4 - Informational (Low)

• S10 – Denial of Service

EPSS

Score: 0.17762
Percentile: 0.94814

CVSS Scoring

Mapped CWE(s)

• CWE-824 : Access of Uninitialized Pointer

Affected Products

• cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*

← Back to Home