ISOMAN

CVE

CVE-2015-1607

kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges."

Severity
MEDIUM
CVSS
5.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=2183683bd633818dd031b090b5530951de76f392
  2. http://www.openwall.com/lists/oss-security/2015/02/13/14
  3. http://www.openwall.com/lists/oss-security/2015/02/14/6
  4. http://www.securityfocus.com/bid/72610
  5. http://www.ubuntu.com/usn/usn-2554-1/
  6. https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html
  7. https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000361.html
  8. https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000362.html
  9. https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html
  10. http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=2183683bd633818dd031b090b5530951de76f392
  11. http://www.openwall.com/lists/oss-security/2015/02/13/14
  12. http://www.openwall.com/lists/oss-security/2015/02/14/6
  13. http://www.securityfocus.com/bid/72610
  14. http://www.ubuntu.com/usn/usn-2554-1/
  15. https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html
  16. https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000361.html
  17. https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000362.html
  18. https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html