Published: 25/06/2014 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The do_uncompress function in g10/compress.c in GnuPG 1.x prior to 1.4.17 and 2.x prior to 2.0.24 allows context-dependent malicious users to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnupg gnupg 2.0.1
gnupg gnupg 2.0.7
gnupg gnupg 2.0.15
gnupg gnupg 2.0.8
gnupg gnupg 2.0.11
gnupg gnupg 2.0.6
gnupg gnupg 2.0.10
gnupg gnupg 2.0.13
gnupg gnupg 2.0
gnupg gnupg 2.0.5
gnupg gnupg 2.0.17
gnupg gnupg 2.0.12
gnupg gnupg 2.0.18
gnupg gnupg 2.0.16
gnupg gnupg 2.0.21
gnupg gnupg 2.0.14
gnupg gnupg 2.0.4
gnupg gnupg 2.0.3
gnupg gnupg 2.0.22
gnupg gnupg 2.0.19
gnupg gnupg 2.0.20
gnupg gnupg 2.0.23
gnupg gnupg 1.4.8
gnupg gnupg 1.2.3
gnupg gnupg 1.3.3
gnupg gnupg 1.0.1
gnupg gnupg 1.4.15
gnupg gnupg 1.3.1
gnupg gnupg 1.2.6
gnupg gnupg 1.4.14
gnupg gnupg 1.3.93
gnupg gnupg 1.3.2
gnupg gnupg 1.4.10
gnupg gnupg 1.4.4
gnupg gnupg 1.4.0
gnupg gnupg 1.2.2
gnupg gnupg 1.3.4
gnupg gnupg 1.4.13
gnupg gnupg 1.0.0
gnupg gnupg
gnupg gnupg 1.4.12
gnupg gnupg 1.3.92
gnupg gnupg 1.0.7
gnupg gnupg 1.2.5
gnupg gnupg 1.0.2
gnupg gnupg 1.0.4
gnupg gnupg 1.3.91
gnupg gnupg 1.2.0
gnupg gnupg 1.0.6
gnupg gnupg 1.0.3
gnupg gnupg 1.2.7
gnupg gnupg 1.4.2
gnupg gnupg 1.4.11
gnupg gnupg 1.4.3
gnupg gnupg 1.4.5
gnupg gnupg 1.2.1
gnupg gnupg 1.2.4
gnupg gnupg 1.0.5
gnupg gnupg 1.3.90
gnupg gnupg 1.3.0
gnupg gnupg 1.3.6
debian debian linux 7.0
opensuse opensuse 12.3
opensuse opensuse 13.1

Debian Bug report logs - #752497 gnupg: CVE-2014-4617: DoS due to garbled compressed data packets Package: src:gnupg; Maintainer for src:gnupg is Debian GnuPG Maintainers <pkg-gnupg-maint@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 24 Jun 2014 06:42:02 UTC Severity: impo ...

GnuPG could be made to hang if it processed a specially crafted message ...

Jean-René Reinhard, Olivier Levillain and Florian Maury reported that GnuPG, the GNU Privacy Guard, did not properly parse certain garbled compressed data packets A remote attacker could use this flaw to mount a denial of service against GnuPG by triggering an infinite loop For the stable distribution (wheezy), this problem has been fixed in ver ...

The do_uncompress function in g10/compressc allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence(CVE-2014-4617) ...

The do_uncompress function in g10/compressc in GnuPG 1x before 1417 and 2x before 2024 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence ...

A scraper and API for the Amazon Linux (2) Security Advisories Bulletin

amzn-alas-query-api A scraper and API for the Amazon Linux (2) Security Advisories Bulletin Description This repository contains an API that can be used to query for known vulnerabilities against a list of Amazon Linux (2) packages It's pretty limited in functionality right now, but I thought what I had so far was kinda cool so figured I'd post to Github The inspira

CWE-20 http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html http://lists.opensuse.org/opensuse-updates/2014-07/msg00010.html http://secunia.com/advisories/59578 http://secunia.com/advisories/59534 http://secunia.com/advisories/59213 http://www.debian.org/security/2014/dsa-2968 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://secunia.com/advisories/59351 http://www.ubuntu.com/usn/USN-2258-1 http://www.debian.org/security/2014/dsa-2967 http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=014b2103fcb12f261135e3954f26e9e07b39e342 http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=11fdfcf82bd8d2b5bc38292a29876e10770f4b0a https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752497 https://usn.ubuntu.com/2258-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-4617

CVE-2014-4617

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect