CVE-2009-1415

Description

lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.

Weakness classification

• CWE-824: Access of Uninitialized Pointer

Primary references

• cve@mitre.org — Broken Link, Patch
• cve@mitre.org — Broken Link
• cve@mitre.org — Broken Link, Vendor Advisory
• cve@mitre.org — Broken Link
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Broken Link, Exploit
• cve@mitre.org — Broken Link
• cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry
• cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry
• cve@mitre.org — Broken Link
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Not Applicable