CVE-2025-32990
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
A heap-buffer-overflow (off-by-one) vulnerability was found in the GnuTLS software in the template parsing logic of the certtool utility. An attacker can exploit this to cause an out-of-bounds NULL pointer write, leading to memory corruption and a denial-of-service (DoS) that could crash the system.
Risk Assessment
The risk is that an attacker could cause a system crash by providing a specially crafted template file, potentially disrupting critical services.
Recommendation
Immediately update GnuTLS to the latest patched version and restrict access to the certtool utility to trusted users only.
Other vulnerabilities in GnuTLS
See all- CVE-2016-4456High
The 'GNUTLS_KEYLOGFILE' environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem.
- CVE-2017-7507High
GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application.
- CVE-2017-7869High
GnuTLS before February 20, 2017, has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue is a subset of the vendor's GNUTLS-SA-2017-3 report and is fixed in version 3.5.10.
- CVE-2017-5335High
The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate.
- CVE-2016-7444High
The gnutls_ocsp_resp_check_crt function in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism.
- CVE-2015-3308High
A double free vulnerability in lib/x509/x509_ext.c in GnuTLS before version 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.
- CVE-2024-28834Medium
A flaw was found in GnuTLS related to the Minerva attack, a cryptographic vulnerability that exploits deterministic behavior, leading to side-channel leaks. In specific scenarios, such as using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce values.
- CVE-2017-5337Critical
Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.
- CVE-2017-5336Critical
A stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.
- CVE-2017-5334Critical
A double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.
Original NVD description (English source)
A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS