CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2025-32988

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.

Score
6.5 medium
Published
2025-07-10
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
security/linux-c7-gnutlslinux-c7-gnutls3.3.29unaddressedemulation@FreeBSD.org

VuXML

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-c7-gnutls</name>
	<range><lt>3.8.10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A flaw was found in GnuTLS. A double-free vulnerability exists in
	GnuTLS due to incorrect ownership handling in the export logic of
	Subject Alternative Name (SAN) entries containing an otherName. If the
	type-id OID is invalid or malformed, GnuTLS will call
	asn1_delete_structure() on an ASN.1 node it does not own, leading to a
	double-free condition when the parent function or caller later
	attempts to free the same structure.

This vulnerability can be
	triggered using only public GnuTLS APIs and may result in denial of
	service or memory corruption, depending on allocator behavior.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-32988</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-32988</url>
    </references>
    <dates>
      <discovery>2025-07-10</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>