PT-2008-3089 · Gnu · Gnupg

Robert Buchholz · Publicado 2008-03-27 · Atualizado 2024-06-15 · CVE-2008-1530

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GnuPG versions 1.4.8 and 2.0.8

Description The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers. This is due to "memory corruption around deduplication of user IDs."

Recommendations For GnuPG version 1.4.8, update to a version that fixes the memory corruption issue. For GnuPG version 2.0.8, update to a version that fixes the memory corruption issue.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2008-1530

OPENSUSE-SU-2024:10815-1

Produtos afetados

Gnupg

Referências · 21

• https://suse.com/security/cve/CVE-2018-9234 · Nota
• https://security-tracker.debian.org/tracker/CVE-2008-1530 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2006-6169 · Nota
• https://suse.com/security/cve/CVE-2020-25125 · Nota
• https://suse.com/security/cve/CVE-2008-1530 · Nota
• https://suse.com/security/cve/CVE-2018-12020 · Nota
• http://ocert.org/advisories/ocert-2008-1.html · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10815-1 · Aviso do Fabricante
• http://lists.gnupg.org/pipermail/gnupg-announce/2008q1/000272.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1530 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1530 · Aviso do Fabricante
• http://secunia.com/advisories/29568 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2008-1530 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-14855 · Nota
• https://suse.com/security/cve/CVE-2006-0455 · Nota