PT-2015-5387 · Gnu+3 · Gnupg+3

Hanno Böck · Published 2015-02-16 · Updated 2019-11-22 · CVE-2015-1607

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GnuPG versions 1.4.18 and earlier GnuPG versions 2.0.x prior to 2.0.27 GnuPG versions 2.1.x prior to 2.1.2

Description The issue is related to the improper handling of bitwise left-shifts in the keybox-search.c file, which can be exploited by remote attackers to cause a denial of service through a crafted keyring file. This is related to sign extensions and "memcpy with overlapping ranges."

Recommendations For GnuPG versions 1.4.18 and earlier, update to version 1.4.19 or later. For GnuPG versions 2.0.x prior to 2.0.27, update to version 2.0.27 or later. For GnuPG versions 2.1.x prior to 2.1.2, update to version 2.1.2 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2015-1842

ALT-PU-2015-2052

CVE-2015-1607

MGASA-2015-0359

SUSE-SU-2015:2170-1

SUSE-SU-2015:2171-1

SUSE-SU-2015:2171-2

USN-2554-1

Affected Products

Alt Linux

Gnupg

Suse

Ubuntu

References · 46

• https://osv.dev/vulnerability/SUSE-SU-2015:2171-2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-1607 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:2170-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-1607 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-1607 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2015-2052 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1607 · Security Note
• https://ubuntu.com/security/CVE-2015-1606 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3591 · Vendor Advisory
• https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1606 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-1607 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5270 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0359 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0359.html · Security Note