CVE-2014-4617
Fixed in a distro release EPSS 3%
The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.
Products: gnupg, debian_linux, opensuse
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | gnupg2 | 2.0.22-5.amzn2.0.3 |
| Amazon Linux 2 | gnupg2-smime | 2.0.22-5.amzn2.0.3 |
| Debian 12 | gnupg2 | 2.0.24-1 |
| Debian 13 | gnupg2 | 2.0.24-1 |
| Debian 14 | gnupg2 | 2.0.24-1 |
| Debian 6.0 | gnupg | 1.4.10-4+squeeze5 |
| Debian 6.0 | gnupg2 | 2.0.14-2+squeeze2 |
| Debian 7 | gnupg | 1.4.12-7+deb7u4 |
| Debian 7 | gnupg2 | 2.0.19-2+deb7u2 |
| Ubuntu 14.04 LTS | gnupg | 1.4.16-1ubuntu2.1 |
| Ubuntu 14.04 LTS | gnupg2 | 2.0.22-3ubuntu1.1 |
| openSUSE Tumbleweed | gpg2 | 2.1.16-1.1 |