SUSE-SU-2012:0807-1: Security update for GnuTLS

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for GnuTLS
______________________________________________________________________________

Announcement ID:    SUSE-SU-2012:0807-1
Rating:             low
References:         #739898 #753301 #754223 
Cross-References:   CVE-2012-0390
Affected Products:
                    SUSE Linux Enterprise Server 10 SP4
                    SUSE Linux Enterprise Desktop 10 SP4
______________________________________________________________________________

   An update that solves one vulnerability and has two fixes
   is now available.

Description:


   This update of GnuTLS fixes multiple vulnerabilities:

   * CVE-2012-1569: remote attackers could cause a denial
   of service (heap memory corruption and application crash)
   via an issue in the asn1_get_length_der() function
   * CVE-2012-1573: crafted GenericBlockCipher structures
   allow remote attackers to cause a denial of service (heap
   memory corruption and application crash)
   * CVE-2012-0390: A vulnerability in the DTLS
   implementation which could allow remote attackers to
   recover partial plaintext via a timing side-channel attack
   was fixed.

   Security Issue reference:

   * CVE-2012-0390
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0390
   >



Package List:

   - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64):

      gnutls-1.2.10-13.30.1
      gnutls-devel-1.2.10-13.30.1

   - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64):

      gnutls-32bit-1.2.10-13.30.1
      gnutls-devel-32bit-1.2.10-13.30.1

   - SUSE Linux Enterprise Server 10 SP4 (ia64):

      gnutls-x86-1.2.10-13.30.1

   - SUSE Linux Enterprise Server 10 SP4 (ppc):

      gnutls-64bit-1.2.10-13.30.1
      gnutls-devel-64bit-1.2.10-13.30.1

   - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64):

      gnutls-1.2.10-13.30.1
      gnutls-devel-1.2.10-13.30.1

   - SUSE Linux Enterprise Desktop 10 SP4 (x86_64):

      gnutls-32bit-1.2.10-13.30.1
      gnutls-devel-32bit-1.2.10-13.30.1


References:

   http://support.novell.com/security/cve/CVE-2012-0390.html
   https://bugzilla.novell.com/739898
   https://bugzilla.novell.com/753301
   https://bugzilla.novell.com/754223
   http://download.novell.com/patch/finder/?keywords=db5ce46e4686a3180984675829d5453e