Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 06 Jan 2015 21:35:29 +1100
From: Joshua Rogers <oss@...ernot.info>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request(s): GnuPG 2/GPG2

On 06/01/15 04:42, cve-assign@...re.org wrote:
>
> What is the attack scenario for these double frees?  It is not
> immediately clear whether there is a role for an attacker who is not
> the GnuPG user.
Here is the response from Werner:

---

>> Double free in scd/command.c:
>> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773471

Could be triggered due to an out of memory condition or a wrong use of a
functions.  Hard to exploit I guess.

>> Double free in sm/minip12.c:
>> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773472

That may happen if iconv_open fails.  Memory error or utf-8 not
available.  Note that the buffer is allocated in out secure memory and
thus the gcry_free() zeroes the memory.  I can't see how this can be
exploted but I am not an expert for this.
--- 


Hopefully that answers the question,


Thanks,
-- 
-- Joshua Rogers <https://internot.info/>


Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.