p PatchFirst

CVE-2015-1606

CVE-2015-1606

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.

CVSS 5.5 · Medium · EPSS 1.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • gnupg2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.0.26-5

    Update to 2.0.26-5

  • gnupg2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.0.26-5

    Update to 2.0.26-5

  • gnupg2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.0.26-5

    Update to 2.0.26-5

  • gnupg Ubuntu:14.04:LTS

    Versions
    • 1.4.14-1ubuntu2
    • 1.4.15-1.1ubuntu1
    • 1.4.15-1.1ubuntu2
    • 1.4.15-2ubuntu1
    • 1.4.16-1ubuntu1
    • 1.4.16-1ubuntu2
    • 1.4.16-1ubuntu2.1
    Affected ranges
    • ECOSYSTEM: < 1.4.16-1ubuntu2.3

    Update to 1.4.16-1ubuntu2.3

  • gnupg2 Ubuntu:14.04:LTS

    Versions
    • 2.0.20-1ubuntu3
    • 2.0.22-1ubuntu1
    • 2.0.22-3ubuntu1
    • 2.0.22-3ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 2.0.22-3ubuntu1.3

    Update to 2.0.22-3ubuntu1.3

Original sources

Check your server →