CVE-2025-32990

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.

References

Affected packages

Debian:11 / gnutls28

Package

Name: gnutls28
Purl: pkg:deb/debian/gnutls28?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.7.1-5+deb11u8

Affected versions

3.*

3.7.1-5

3.7.1-5+deb11u1

3.7.1-5+deb11u2

3.7.1-5+deb11u3

3.7.1-5+deb11u4

3.7.1-5+deb11u5

3.7.1-5+deb11u6

3.7.1-5+deb11u7

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / gnutls28

Package

Name: gnutls28
Purl: pkg:deb/debian/gnutls28?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.7.9-2+deb12u5

Affected versions

3.*

3.7.9-2

3.7.9-2+deb12u1

3.7.9-2+deb12u2

3.7.9-2+deb12u3

3.7.9-2+deb12u4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / gnutls28

Package

Name: gnutls28
Purl: pkg:deb/debian/gnutls28?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.8.9-3

Ecosystem specific

{
    "urgency": "not yet assigned"
}