CVE-2013-2116: gnu gnutls Improper Input Validation

EPSS trend

Probability

3.76%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

0.00 pp

From 3.76% on 18-09-2026

18-09-202618-10-2026

EPSS score

3.76%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

29 links

secunia.com/advisories/57260Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2013-06/msg00019.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/57274Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.htmlVendor AdvisoryX Refsource SUSE
www.mandriva.com/security/advisories?name=MDVSA-2013:171Vendor AdvisoryX Refsource MANDRIVA
rhn.redhat.com/errata/RHSA-2013-0883.htmlVendor AdvisoryX Refsource REDHAT
www.debian.org/security/2013/dsa-2697Vendor AdvisoryX Refsource DEBIAN
thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/6754X Refsource CONFIRM
www.gnutls.org/security.htmlX Refsource CONFIRM

Show all 29 references

secunia.com/advisories/53911Third Party AdvisoryX Refsource SECUNIAVendor Advisory
gitorious.org/gnutls/gnutls/commit/5164d5a1d57cd0372a5dd074382ca960ca18b27dX Refsource CONFIRM
www.ubuntu.com/usn/USN-1843-1Vendor AdvisoryX Refsource UBUNTU
www.securitytracker.com/id/1028603VDB EntryX Refsource SECTRACK
thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/6753X Refsource MISC
access.redhat.com/errata/RHSA-2013:0883Advisory
access.redhat.com/security/updates/classification/ARTICLE
rhn.redhat.com/errata/RHSA-2013-0588.htmlARTICLE
bugzilla.redhat.com/show_bug.cgi?id=966754REPORT
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0883.jsonAdvisory
access.redhat.com/security/cve/CVE-2013-2116REPORT
www.cve.org/CVERecord?id=CVE-2013-2116Advisory
nvd.nist.gov/vuln/detail/CVE-2013-2116Advisory
access.redhat.com/errata/RHSA-2013:1076Advisory
rhn.redhat.com/errata/RHSA-2013-0636.htmlARTICLE
rhn.redhat.com/errata/RHBA-2013-1077.htmlARTICLE
access.redhat.com/site/…ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=980489REPORT
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1076.jsonAdvisory

Related vulnerabilities

CVE-2018-16868debiangnutls28+100.58%7y ago03-12-2018 14:00A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.CVE-2018-10844canonicalubuntu_linux+103.62%8y ago22-08-2018 13:00It was found that the GnuTLS implementation of HMAC-SHA-256 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data using crafted packets.CVE-2018-10845canonicalubuntu_linux+103.62%8y ago22-08-2018 13:00It was found that the GnuTLS implementation of HMAC-SHA-384 was vulnerable to a Lucky thirteen style attack. Remote attackers could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.CVE-2018-10846canonicalubuntu_linux+100.39%8y ago22-08-2018 13:00A cache-based side channel in GnuTLS implementation that leads to plain text recovery in cross-VM attack setting was found. An attacker could use a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack to recover plain text using crafted packets.CVE-2013-1619debiangnutls28+76.44%13y ago08-02-2013 19:00The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.CVE-2025-32988alpinegnutls+51.47%1y ago10-07-2025 08:04A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.

All vulnerabilities ingnutls

CVE-2013-2116: gnu gnutls Improper Input Validation

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References