CVE-2015-1607
Fixed in a distro release EPSS 2%
kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges."
Products: gnupg, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | gnupg2 | 2.0.26-5 |
| Debian 13 | gnupg2 | 2.0.26-5 |
| Debian 14 | gnupg2 | 2.0.26-5 |
| SUSE Linux Enterprise Desktop 11 SP3 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Desktop 11 SP4 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Desktop 12 | gpg2 | 2.0.24-3.2 |
| SUSE Linux Enterprise Desktop 12 SP1 | gpg2 | 2.0.24-3.2 |
| SUSE Linux Enterprise Server 11 SP3 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Server 11 SP4 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Server 12 | gpg2 | 2.0.24-3.2 |
| SUSE Linux Enterprise Server 12 SP1 | gpg2 | 2.0.24-3.2 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP3 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | gpg2 | 2.0.9-25.33.41.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 | gpg2 | 2.0.24-3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | gpg2 | 2.0.24-3.2 |
| Ubuntu 14.04 LTS | gnupg | 1.4.16-1ubuntu2.3 |
| Ubuntu 14.04 LTS | gnupg2 | 2.0.22-3ubuntu1.3 |