Published: 24/01/2013 Updated: 13/02/2023

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P

The read_block function in g10/import.c in GnuPG 1.4.x prior to 1.4.13 and 2.0.x up to and including 2.0.19, when importing a key, allows remote malicious users to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnupg gnupg 1.4.8
gnupg gnupg 1.4.10
gnupg gnupg 1.4.4
gnupg gnupg 1.4.0
gnupg gnupg 1.4.12
gnupg gnupg 1.4.2
gnupg gnupg 1.4.11
gnupg gnupg 1.4.3
gnupg gnupg 1.4.5
gnupg gnupg 2.0.1
gnupg gnupg 2.0.7
gnupg gnupg 2.0.15
gnupg gnupg 2.0.8
gnupg gnupg 2.0.11
gnupg gnupg 2.0.6
gnupg gnupg 2.0.10
gnupg gnupg 2.0.13
gnupg gnupg 2.0
gnupg gnupg 2.0.5
gnupg gnupg 2.0.17
gnupg gnupg 2.0.12
gnupg gnupg 2.0.18
gnupg gnupg 2.0.16
gnupg gnupg 2.0.14
gnupg gnupg 2.0.4
gnupg gnupg 2.0.3
gnupg gnupg 2.0.19

Debian Bug report logs - #697108 gnupg key import memory corruption Package: gnupg; Maintainer for gnupg is Debian GnuPG Maintainers <pkg-gnupg-maint@listsaliothdebianorg>; Source for gnupg is src:gnupg2 (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Tue, 1 Jan 2013 14:30:01 UTC Sev ...

GnuPG could be made to corrupt the keyring if it imported a specially crafted key ...

Synopsis Moderate: gnupg security update Type/Severity Security Advisory: Moderate Topic An updated gnupg package that fixes multiple security issues is nowavailable for Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerabilit ...

Synopsis Moderate: gnupg2 security update Type/Severity Security Advisory: Moderate Topic An updated gnupg2 package that fixes three security issues is now availablefor Red Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnera ...

KB Sriram discovered that GnuPG, the GNU Privacy Guard did not sufficiently sanitise public keys on import, which could lead to memory and keyring corruption The problem affects both version 1, in the gnupg package, and version two, in the gnupg2 package For the stable distribution (squeeze), this problem has been fixed in version 1410-4+squeez ...

CWE-20 http://www.openwall.com/lists/oss-security/2013/01/01/6 https://bugzilla.redhat.com/show_bug.cgi?id=891142 http://www.securityfocus.com/bid/57102 http://www.mandriva.com/security/advisories?name=MDVSA-2013:001 https://bugs.g10code.com/gnupg/issue1455 http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095513.html http://www.ubuntu.com/usn/USN-1682-1 http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095516.html http://rhn.redhat.com/errata/RHSA-2013-1459.html https://exchange.xforce.ibmcloud.com/vulnerabilities/80990 http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commitdiff%3Bh=f0b33b6fb8e0586e9584a7a409dcc31263776a67 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=697108 https://usn.ubuntu.com/1682-1/https://nvd.nist.gov

CVE-2012-6085

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect