CVEvulnerability

CVE-2019-3836

7.5 HIGH Published 2019-04-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-04-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.9 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-456, CWE-824

Description

It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.

Affected configurations

• gnu gnutls (>= 3.6.3 < 3.6.7) • fedoraproject fedora 28 • opensuse leap 15.0

Related

Weakness · CWE (2)

  • CWE-456 Missing Initialization of a Variable weakness
  • CWE-824 Access of Uninitialized Pointer weakness

Referenced by CWE · observed example (2)

  • CWE-456 Missing Initialization of a Variable weakness
  • CWE-824 Access of Uninitialized Pointer weakness

References