CVE-2016-4354
Fixed in a distro release EPSS 2%
ber-decoder.c in Libksba before 1.3.3 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (crash) via crafted BER data, which leads to a buffer overflow.
Products: canonical ubuntu_linux, gnupg libksba
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libksba | 1.3.3-1 |
| Debian 13 | libksba | 1.3.3-1 |
| Debian 14 | libksba | 1.3.3-1 |
| Ubuntu 14.04 LTS | libksba | 1.3.0-3ubuntu0.14.04.2 |
| Ubuntu 16.04 LTS | libksba | 1.3.3-1ubuntu0.16.04.1 |