Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5.1
CVSSv2

CVE-2010-2547

Published: 05/08/2010 Updated: 02/02/2024
CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9
CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2
VMScore: 454
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Subscribe to Gnupg

Vulnerability Summary

Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x up to and including 2.0.16 allows remote malicious users to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.

Vulnerable Product Search on Vulmon Subscribe to Product

gnupg gnupg

fedoraproject fedora 13

debian debian linux 5.0

Vendor Advisories

Red Hat: Moderate: gnupg2 security update
Synopsis Moderate: gnupg2 security update Type/Severity Security Advisory: Moderate Topic An updated gnupg2 package that fixes one security issue is now availablefor Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as having moderatesecurity impact A Common Vulnerability ...
Ubuntu Security Notice: gnupg2 vulnerability
It was discovered that GPGSM in GnuPG2 did not correctly handle certificates with a large number of Subject Alternate Names If a user or automated system were tricked into processing a specially crafted certificate, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program ...

References

CWE-416http://www.debian.org/security/2010/dsa-2076http://www.securitytracker.com/id?1024247http://secunia.com/advisories/38877http://secunia.com/advisories/40718http://www.mandriva.com/security/advisories?name=MDVSA-2010:143http://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.htmlhttp://www.vupen.com/english/advisories/2010/1988http://www.vupen.com/english/advisories/2010/1931http://www.vupen.com/english/advisories/2010/1950http://lists.fedoraproject.org/pipermail/package-announce/2010-August/044935.htmlhttp://www.securityfocus.com/bid/41945http://secunia.com/advisories/40841http://www.vupen.com/english/advisories/2010/2217http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.462008http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.htmlhttps://issues.rpath.com/browse/RPL-3229http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0076http://www.vupen.com/english/advisories/2010/3125https://access.redhat.com/errata/RHSA-2010:0603https://usn.ubuntu.com/970-1/https://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3400CVE-2023-7252CVE-2024-21111denial of serviceCVE-2024-29661CVE-2024-22856remote attackersencryptionCVE-2023-38299
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook