Skip to content
OpenAdvisories
Unscored USN-2554-1 5 CVEs

gnupg, gnupg2 vulnerabilities

Published Apr 1, 2015 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Daniel Genkin, Lev Pachmanov, Itamar Pipman, and Eran Tromer discovered
that GnuPG was susceptible to an attack via physical side channels. A local
attacker could use this attack to possibly recover private keys.
(CVE-2014-3591)

Daniel Genkin, Adi Shamir, and Eran Tromer discovered that GnuPG was
susceptible to an attack via physical side channels. A local attacker could
use this attack to possibly recover private keys. (CVE-2015-0837)

Hanno Böck discovered that GnuPG incorrectly handled certain malformed
keyrings. If a user or automated system were tricked into opening a
malformed keyring, a remote attacker could use this issue to cause GnuPG to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2015-1606, CVE-2015-1607)

In addition, this update improves GnuPG security by validating that the
keys returned by keyservers match those requested.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS gnupg 1.4.16-1ubuntu2.3
Ubuntu · 14.04 LTS 14.04:LTS gnupg2 2.0.22-3ubuntu1.3

Vulnerabilities 5

References

  • report
    https://ubuntu.com/security/CVE-2014-3591
  • report
    https://ubuntu.com/security/CVE-2014-5270
  • report
    https://ubuntu.com/security/CVE-2015-0837
  • report
    https://ubuntu.com/security/CVE-2015-1606
  • report
    https://ubuntu.com/security/CVE-2015-1607