Two GnuTLS Bugfix Releases
The GnuTLS project has published two bugfix releases to close several vulnerabilities and resolve an error capable of interrupting connections.
The developers closed down three security holes in the GnuTLS encryption library in version 2.2.4, however, the release introduced a new bug. According to security researchers Secunia, the vulnerabilities closed by the 2.2.4 release were extremely critical.
Attackers could exploit the three bugs to perform denial of service attacks: a sign error in the "_gnutls_ciphertext2compressed()" function, which is part of the "lib/gnutls_cipher.c" library, led to a read/write error capable of crashing applications affected by it. Two further errors occurred in "Client Hello" message processing – attackers could exploit the first error by injecting a manipulated "Server Name" extension to trigger a heap based buffer overflow which could then be exploited to execute arbitrary code. The second error was a null pointer dereference that could cause the application to crash. All of these vulnerabilities were confirmed for all GnuTLS versions prior to 2.2.4.
Version 2.2.5 published the same day removes errors introduced by the developers in 2.2.4, mainly a bug that caused interruptions to service.
The stable release and patches for older versions are available for downloading from various mirror servers. For more information on the vulnerabilities by the developers themselves, visit the GnuTLS website.
Issue 234/2020
Buy this issue as a PDF
News
-
System76 is Developing a New Keyboard
The company behind the incredibly powerful Thelio desktop is developing a new keyboard.
-
Zorin OS 15.2 Now Available
The latest release of Zorin OS offers numerous improvements.
-
Firefox to Get an Additional Sandbox Layer
Starting with Firefox 74, the open source web browser will include the new RLBox security feature.
-
Microsoft Defender ATP is Coming to Linux
Microsoft is ramping up its efforts to fight attackers across all platforms.
-
South Korean Government Considers Move to Linux Desktop
Seoul Mulls Migrating from Windows to Linux.
-
OpenSSH Now Supports FIDO/U2F Security Keys
SSH users can now add FIDO/U2F to the list of supported multi-factor authentication tools.
-
System76 Launches New AMD Threadripper Machine
System76 has added an AMD Threadripper option for their Thelio desktop lineup.
-
LibreOffice 6.4 Released
The unofficial office suite for the Linux platform has performance in mind for users.
-
Official Evernote Client Coming to Linux
The most widely-used note-taking app is coming to Linux.
-
Thanks to Linux, Google and Valve are Bringing Steam to Chromebooks
In yet another win for desktop Linux, Google and Steam are about to up the Chromebook gaming field.