CVE-2014-9087
Fixed in a distro release EPSS 6%
Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.
Products: mageia, debian_linux, gnupg libksba, canonical ubuntu_linux, gnupg
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libksba | 1.3.2-1 |
| Debian 13 | libksba | 1.3.2-1 |
| Debian 14 | libksba | 1.3.2-1 |
| Debian 6.0 | libksba | 1.0.7-2+deb6u1 |
| Debian 7 | libksba | 1.2.0-2+deb7u1 |
| Ubuntu 14.04 LTS | libksba | 1.3.0-3ubuntu0.14.04.1 |
| openSUSE Tumbleweed | libksba | 1.3.5-1.3 |