oss-security - CVE request: GnuPG Import Key Memory Corruption

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 27 Mar 2008 01:58:40 +0100
From: Robert Buchholz <rbu@...too.org>
To: coley@...re.org
Cc: lcars@...rt.org,
 oss-security@...ts.openwall.com,
 wk@...pg.org
Subject: CVE request: GnuPG Import Key Memory Corruption

Hi,

there's a memory corruption triggered when importing malformed keys 
using GnuPG 1.4.8 and 2.0.8. Prior and later versions are not affected. 
Exploitability to execute code is unknown.

References:
http://www.ocert.org/advisories/ocert-2008-1.html
https://bugs.g10code.com/gnupg/issue894
https://bugs.gentoo.org/show_bug.cgi?id=214990


Thanks,
Robert


Download attachment "signature.asc " of type "application/pgp-signature" (190 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.