net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

Debian DLA-51-1 : gnupg2 security update

Jean-Rene Reinhard, Olivier Levillain and Florian Maury reported that GnuPG, the GNU Privacy Guard, did not properly parse certain garbled compressed data packets. A remote attacker could use this flaw to mount a denial of service against GnuPG by triggering an infinite loop. NOTE: Tenable Networ...

Updated gnupg & gnupg2 packages fixes CVE-2014-4617

Updated gnupg and gnupg2 packages fix security vulnerability: GnuPG versions before 1.4.17 and 2.0.24 are vulnerable to a denial of service which can be caused by garbled compressed data packets which may put gpg into an infinite loop CVE-2014-4617...

gnupg -- possible DoS using garbled compressed data packets

Werner Koch reports: This release includes a security fix to stop a possible DoS using garbled compressed data packets which can be used to put gpg into an infinite loop...