CVE-2009-1415: gnu gnutls Access of Uninitialized Pointer

EPSS trend

Probability

7.92%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 7.92% on 20-09-2026

20-09-202620-10-2026

EPSS score

7.92%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (thread.gmane.org)
Maturity: unknown
exploit-databasedoslinuxVerified
GnuTLS 2.6.x - libgnutls lib/pk-libgcrypt.c Malformed DSA Key Handling Remote Denial of Service
Maturity: poc

References

13 links

exchange.xforce.ibmcloud.com/vulnerabilities/50445VDB EntryX Refsource XFThird Party Advisory
permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3502Mailing ListX Refsource MLISTBroken Link
article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515Mailing ListX Refsource MLISTBroken LinkPatch
exchange.xforce.ibmcloud.com/vulnerabilities/50257VDB EntryX Refsource XFThird Party Advisory
thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3488X Refsource CONFIRMBroken LinkExploit
exchange.xforce.ibmcloud.com/vulnerabilities/50260VDB EntryX Refsource XFNot Applicable
www.vupen.com/english/advisories/2009/1218VDB EntryX Refsource VUPENBroken Link
www.securityfocus.com/bid/34783VDB EntryX Refsource BIDBroken LinkThird Party Advisory
security.gentoo.org/glsa/glsa-200905-04.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.securitytracker.com/id?1022157VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory

Show all 13 references

secunia.com/advisories/34842Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
secunia.com/advisories/35211Third Party AdvisoryX Refsource SECUNIABroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:116Vendor AdvisoryX Refsource MANDRIVABroken Link

Related vulnerabilities

CVE-2018-16868debiangnutls28+100.58%7y ago03-12-2018 14:00A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.CVE-2018-10844canonicalubuntu_linux+103.62%8y ago22-08-2018 13:00It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.CVE-2018-10845canonicalubuntu_linux+103.62%8y ago22-08-2018 13:00It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.CVE-2018-10846canonicalubuntu_linux+100.39%8y ago22-08-2018 13:00A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.CVE-2013-2116debiangnutls26+73.76%13y ago03-07-2013 18:00The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169.CVE-2013-1619debiangnutls28+76.44%13y ago08-02-2013 19:00The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

All vulnerabilities ingnutls

CVE-2009-1415: gnu gnutls Access of Uninitialized Pointer

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References