Published: 20/11/2019 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

The keyring DB in GnuPG prior to 2.1.2 does not properly handle invalid packets, which allows remote malicious users to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnupg gnupg
debian debian linux 8.0
debian debian linux 7.0

Debian Bug report logs - #778577 CVE-2015-1606 CVE-2015-1607 -- multiple issues found in GnuPG Package: gnupg2; Maintainer for gnupg2 is Debian GnuPG Maintainers <pkg-gnupg-maint@listsaliothdebianorg>; Source for gnupg2 is src:gnupg2 (PTS, buildd, popcon) Reported by: Daniel Kahn Gillmor <dkg@fifthhorsemannet> D ...

Several security issues were fixed in GnuPG ...

Multiple vulnerabilities were discovered in GnuPG, the GNU Privacy Guard: CVE-2014-3591 The Elgamal decryption routine was susceptible to a side-channel attack discovered by researchers of Tel Aviv University Ciphertext blinding was enabled to counteract it Note that this may have a quite noticeable impact on Elgamal decryption p ...

It was <a href="blogfuzzing-projectorg/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015html">reported</a> that gnupg2 keyring DB code did not reject packets which don't belong into a keyring, which may lead to invalid read of sizeof (int) ...

CWE-416 http://www.openwall.com/lists/oss-security/2015/02/14/6 http://www.securitytracker.com/id/1031876 http://www.debian.org/security/2015/dsa-3184 https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html http://www.openwall.com/lists/oss-security/2015/02/13/14 http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=f0f71a721ccd7ab9e40b8b6b028b59632c0cc648 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778577 https://usn.ubuntu.com/2554-1/https://nvd.nist.gov

CVE-2015-1606

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect