Published: 01/12/2014 Updated: 18/05/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Integer underflow in the ksba_oid_to_str function in Libksba prior to 1.3.2, as used in GnuPG, allows remote malicious users to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mageia mageia 3.0
mageia mageia 4.0
debian debian linux 8.0
debian debian linux 7.0
gnupg libksba
canonical ubuntu linux 14.10
canonical ubuntu linux 12.04
canonical ubuntu linux 14.04
gnupg gnupg 2.1.0

Debian Bug report logs - #770972 libksba: CVE-2014-9087: buffer overflow in ksba_oid_to_str Package: src:libksba; Maintainer for src:libksba is Debian GnuTLS Maintainers <pkg-gnutls-maint@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 25 Nov 2014 15:18:13 UTC Severity: grav ...

Libksba could be made to crash or run programs if it opened a specially crafted file ...

An integer underflow flaw, leading to a heap-based buffer overflow, was found in the ksba_oid_to_str() function of libksba, an X509 and CMS (PKCS#7) library By using special crafted S/MIME messages or ECC based OpenPGP data, it is possible to create a buffer overflow, which could cause an application using libksba to crash (denial of service), or ...

CWE-191 http://secunia.com/advisories/60189 http://secunia.com/advisories/60073 http://secunia.com/advisories/60233 https://blog.fuzzing-project.org/2-Buffer-overflow-and-other-minor-issues-in-GnuPG-and-libksba-TFPA-0012014.html http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html http://www.ubuntu.com/usn/USN-2427-1 http://www.debian.org/security/2014/dsa-3078 http://advisories.mageia.org/MGASA-2014-0498.html http://www.mandriva.com/security/advisories?name=MDVSA-2014:234 http://www.mandriva.com/security/advisories?name=MDVSA-2015:151 http://www.securityfocus.com/bid/71285 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770972 https://usn.ubuntu.com/2427-1/https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-9087

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect