Published: 20/11/2019 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

The keyring DB in GnuPG prior to 2.1.2 does not properly handle invalid packets, which allows remote malicious users to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnupg gnupg
debian debian linux 8.0
debian debian linux 7.0

Several security issues were fixed in GnuPG ...

Debian Bug report logs - #778577 CVE-2015-1606 CVE-2015-1607 -- multiple issues found in GnuPG Package: gnupg2; Maintainer for gnupg2 is Debian GnuPG Maintainers <pkg-gnupg-maint@listsaliothdebianorg>; Source for gnupg2 is src:gnupg2 (PTS, buildd, popcon) Reported by: Daniel Kahn Gillmor <dkg@fifthhorsemannet> D ...

Multiple vulnerabilities were discovered in GnuPG, the GNU Privacy Guard: CVE-2014-3591 The Elgamal decryption routine was susceptible to a side-channel attack discovered by researchers of Tel Aviv University Ciphertext blinding was enabled to counteract it Note that this may have a quite noticeable impact on Elgamal decryption p ...

It was <a href="blogfuzzing-projectorg/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015html">reported</a> that gnupg2 keyring DB code did not reject packets which don't belong into a keyring, which may lead to invalid read of sizeof (int) ...

CWE-416 http://www.openwall.com/lists/oss-security/2015/02/14/6 http://www.securitytracker.com/id/1031876 http://www.debian.org/security/2015/dsa-3184 https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html http://www.openwall.com/lists/oss-security/2015/02/13/14 http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=f0f71a721ccd7ab9e40b8b6b028b59632c0cc648 https://nvd.nist.gov https://usn.ubuntu.com/2554-1/

CVE-2015-1606

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect