[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0803271838420.14208@faron.mitre.org>
Date: Thu, 27 Mar 2008 18:39:16 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Robert Buchholz <rbu@...too.org>
cc: coley@...re.org, lcars@...rt.org, oss-security@...ts.openwall.com,
wk@...pg.org
Subject: Re: CVE request: GnuPG Import Key Memory Corruption
======================================================
Name: CVE-2008-1530
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1530
Reference: MISC:http://www.ocert.org/advisories/ocert-2008-1.html
Reference: CONFIRM:https://bugs.g10code.com/gnupg/issue894
Reference: CONFIRM:https://bugs.gentoo.org/show_bug.cgi?id=214990
GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial
of service (crash) and possibly execute arbitrary code via crafted
duplicate keys that are imported from key servers, which triggers
"memory corruption around deduplication of user IDs."
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
