CVE-2015-1606
Fixed in a distro release EPSS 2%
The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.
Products: gnupg, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | gnupg2 | 2.0.26-5 |
| Debian 13 | gnupg2 | 2.0.26-5 |
| Debian 14 | gnupg2 | 2.0.26-5 |
| Debian 6.0 | gnupg | 1.4.10-4+squeeze7 |
| Debian 7 | gnupg | 1.4.12-7+deb7u7 |
| SUSE Linux Enterprise Desktop 11 SP3 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Desktop 11 SP4 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Desktop 12 | gpg2 | 2.0.24-3.2 |
| SUSE Linux Enterprise Desktop 12 SP1 | gpg2 | 2.0.24-3.2 |
| SUSE Linux Enterprise Server 11 SP3 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Server 11 SP4 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Server 12 | gpg2 | 2.0.24-3.2 |
| SUSE Linux Enterprise Server 12 SP1 | gpg2 | 2.0.24-3.2 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP3 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 | gpg2 | 2.0.24-3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | gpg2 | 2.0.24-3.2 |
| Ubuntu 14.04 LTS | gnupg | 1.4.16-1ubuntu2.3 |
| Ubuntu 14.04 LTS | gnupg2 | 2.0.22-3ubuntu1.3 |