Description
The libksba library 0.9.12 and possibly other versions, as used by gpgsm in the newpg package on SUSE LINUX, allows attackers to cause a denial of service (application crash) via a malformed X.509 certificate in a signature.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libksba | 0.9.14-1 | — |
| Debian 13 | libksba | 0.9.14-1 | — |
| Debian 12 | libksba | 0.9.14-1 | — |
References
- 22473 third-party-advisory
- SUSE-SR:2006:023 vendor-advisory
- libksba-x509-dos(29621) vdb-entry
- 22423 third-party-advisory
- MDKSA-2006:183 vendor-advisory
- http://www.novell.com/linux/download/updates/101_x86_64.html
- USN-365-1 vendor-advisory
- 20565 vdb-entry
- 22445 third-party-advisory