oss-security - CVE request: GnuPG Import Key Memory Corruption

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Thu, 27 Mar 2008 01:58:40 +0100
From: Robert Buchholz <rbu@...too.org>
To: coley@...re.org
Subject: CVE request: GnuPG Import Key Memory Corruption

Hi,

there's a memory corruption triggered when importing malformed keys 
using GnuPG 1.4.8 and 2.0.8. Prior and later versions are not affected. 
Exploitability to execute code is unknown.

References:
http://www.ocert.org/advisories/ocert-2008-1.html
https://bugs.g10code.com/gnupg/issue894
https://bugs.gentoo.org/show_bug.cgi?id=214990

Thanks,
Robert

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.