Skip to content
OpenAdvisories
Unscored CVE-2015-1606 EUVD-2015-1737GHSA-p6r5-7hm9-22q4

The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (…

Published Nov 20, 2019 · Updated Aug 6, 2024 · Assigned by mitre

Package: gnupg Package: gnupg2 Package: gnupg2 Ecosystem: Debian Ecosystem: Ubuntu

Description

The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 gnupg2 2.0.26-5 —
Debian 13 gnupg2 2.0.26-5 —
Debian 12 gnupg2 2.0.26-5 —
Debian 7 gnupg 1.4.12-7+deb7u7 DSA-3184-1
Debian 6.0 gnupg 1.4.10-4+squeeze7 DLA-175-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS gnupg 1.4.16-1ubuntu2.3 USN-2554-1
Ubuntu 14.04 LTS gnupg2 2.0.22-3ubuntu1.3 USN-2554-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP1 gpg2 2.0.24-3.2 SUSE-SU-2015:2171-2
SLES 12 gpg2 2.0.24-3.2 SUSE-SU-2015:2171-1
SLES 11 SP4 gpg2 2.0.9-25.33.41.2 SUSE-SU-2015:2170-1
SLES 11 SP3 gpg2 2.0.9-25.33.41.2 SUSE-SU-2015:2170-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP1 gpg2 2.0.24-3.2 SUSE-SU-2015:2171-2
SLES for SAP 12 gpg2 2.0.24-3.2 SUSE-SU-2015:2171-1
SLES for SAP 11 SP4 gpg2 2.0.9-25.33.41.2 SUSE-SU-2015:2170-1
SLES for SAP 11 SP3 gpg2 2.0.9-25.33.41.2 SUSE-SU-2015:2170-1

Advisories 6

References