oss-security - CVE request: GnuPG Import Key Memory Corruption

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 27 Mar 2008 01:58:40 +0100
From: Robert Buchholz <rbu@...too.org>
To: coley@...re.org
Cc: lcars@...rt.org,
 oss-security@...ts.openwall.com,
 wk@...pg.org
Subject: CVE request: GnuPG Import Key Memory Corruption

Hi,

there's a memory corruption triggered when importing malformed keys 
using GnuPG 1.4.8 and 2.0.8. Prior and later versions are not affected. 
Exploitability to execute code is unknown.

References:
http://www.ocert.org/advisories/ocert-2008-1.html
https://bugs.g10code.com/gnupg/issue894
https://bugs.gentoo.org/show_bug.cgi?id=214990


Thanks,
Robert


[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.