Published: 20/10/2014 Updated: 13/02/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Multiple heap-based buffer overflows in the status_handler function in (1) engine-gpgsm.c and (2) engine-uiserver.c in GPGME prior to 1.5.1 allow remote malicious users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to "different line lengths in a specific order."

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu gpgme
debian debian linux 6.0
canonical ubuntu linux 12.04
canonical ubuntu linux 10.04

Debian Bug report logs - #756651 gpgme10: CVE-2014-3564: heap-based buffer overflow in gpgsm status handler Package: src:gpgme10; Maintainer for src:gpgme10 is Debian GnuPG Maintainers <pkg-gnupg-maint@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 31 Jul 2014 19:48:01 UT ...

GPGME could be made to crash or run programs as your login if it processed a specially crafted certificate ...

Tomáš Trnka discovered a heap-based buffer overflow within the gpgsm status handler of GPGME, a library designed to make access to GnuPG easier for applications An attacker could use this issue to cause an application using GPGME to crash (denial of service) or possibly to execute arbitrary code For the stable distribution (wheezy), this proble ...

Multiple heap-based buffer overflows in the status_handler function in (1) engine-gpgsmc and (2) engine-uiserverc in GPGME before 151 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to "different line lengths in a specific order" ...

CWE-119 http://seclists.org/oss-sec/2014/q3/266 http://www.osvdb.org/109699 https://bugzilla.redhat.com/show_bug.cgi?id=1113267 http://www.securityfocus.com/bid/68990 http://www.debian.org/security/2014/dsa-3005 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git%3Ba=commit%3Bh=2cbd76f7911fc215845e89b50d6af5ff4a83dd77 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756651 https://usn.ubuntu.com/2307-1/https://nvd.nist.gov

CVE-2014-3564

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect