7.5
CVSSv3

CVE-2016-4021

Published: 26/05/2016 Updated: 15/06/2016
CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 694
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Vulnerability Summary

The read_binary function in buffer.c in pgpdump prior to 0.30 allows context-dependent malicious users to cause a denial of service (infinite loop and CPU consumption) via crafted input, as demonstrated by the \xa3\x03 string.

Vulnerable Product Search on Vulmon Subscribe to Product

fedoraproject fedora 23

fedoraproject fedora 22

fedoraproject fedora 24

pgpdump project pgpdump

Vendor Advisories

Debian Bug report logs - #773747 pgpdump: CVE-2016-4021: endless loop parsing specially crafted input Package: pgpdump; Maintainer for pgpdump is Debian GnuPG Maintainers <pkg-gnupg-maint@listsaliothdebianorg>; Source for pgpdump is src:pgpdump (PTS, buildd, popcon) Reported by: Jakub Wilk <jwilk@debianorg> Date: ...

Exploits

pgpdump version 029 suffers from an endless loop parsing issue that can lead to a denial of service ...