Test ID:	1.3.6.1.4.1.25623.1.0.843098
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-3183-2)
Summary:	The remote host is missing an update for the 'gnutls26' package(s) announced via the USN-3183-2 advisory.
Description:	Summary: The remote host is missing an update for the 'gnutls26' package(s) announced via the USN-3183-2 advisory. Vulnerability Insight: USN-3183-1 fixed CVE-2016-8610 in GnuTLS in Ubuntu 16.04 LTS and Ubuntu 16.10. This update provides the corresponding update for Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Original advisory details: Stefan Buehler discovered that GnuTLS incorrectly verified the serial length of OCSP responses. A remote attacker could possibly use this issue to bypass certain certificate validation measures. This issue only applied to Ubuntu 16.04 LTS. (CVE-2016-7444) Shi Lei discovered that GnuTLS incorrectly handled certain warning alerts. A remote attacker could possibly use this issue to cause GnuTLS to hang, resulting in a denial of service. This issue has only been addressed in Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8610) It was discovered that GnuTLS incorrectly decoded X.509 certificates with a Proxy Certificate Information extension. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5334) It was discovered that GnuTLS incorrectly handled certain OpenPGP certificates. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337) Affected Software/OS: 'gnutls26' package(s) on Ubuntu 12.04, Ubuntu 14.04. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-8610 1037084 http://www.securitytracker.com/id/1037084 93841 http://www.securityfocus.com/bid/93841 DSA-3773 https://www.debian.org/security/2017/dsa-3773 FreeBSD-SA-16:35 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc RHSA-2017:0286 http://rhn.redhat.com/errata/RHSA-2017-0286.html RHSA-2017:0574 http://rhn.redhat.com/errata/RHSA-2017-0574.html RHSA-2017:1413 https://access.redhat.com/errata/RHSA-2017:1413 RHSA-2017:1414 https://access.redhat.com/errata/RHSA-2017:1414 RHSA-2017:1415 http://rhn.redhat.com/errata/RHSA-2017-1415.html RHSA-2017:1658 https://access.redhat.com/errata/RHSA-2017:1658 RHSA-2017:1659 http://rhn.redhat.com/errata/RHSA-2017-1659.html RHSA-2017:1801 https://access.redhat.com/errata/RHSA-2017:1801 RHSA-2017:1802 https://access.redhat.com/errata/RHSA-2017:1802 RHSA-2017:2493 https://access.redhat.com/errata/RHSA-2017:2493 RHSA-2017:2494 https://access.redhat.com/errata/RHSA-2017:2494 [oss-security] 20161024 CVE-2016-8610: SSL Death Alert: OpenSSL SSL/TLS SSL3_AL_WARNING undefined alert Remote DoS http://seclists.org/oss-sec/2016/q4/224 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610 https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401 https://security.360.cn/cve/CVE-2016-8610/ https://security.netapp.com/advisory/ntap-20171130-0001/ https://security.paloaltonetworks.com/CVE-2016-8610 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us https://www.oracle.com/security-alerts/cpuapr2020.html https://www.oracle.com/security-alerts/cpujan2020.html https://www.oracle.com/security-alerts/cpujul2020.html https://www.oracle.com/security-alerts/cpuoct2020.html https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.