remote code execution in gpg,liby2util

2006-02-2016:55:38

lists.opensuse.org

0.002 Low

EPSS

Percentile

59.5%

JSON

With certain handcraftable signatures GPG was returning a 0 (valid signature) when used on command-line with option --verify.

Solution

There is no known workaround, please install the update packages.

OSVersionArchitecturePackageVersionFilename
openSUSE10.0i586gpg< 1.4.2-5.2gpg-1.4.2-5.2.i586.rpm
openSUSE10.0i586liby2util< 2.12.9-0.3liby2util-2.12.9-0.3.i586.rpm
openSUSE9.3i586liby2util< 2.11.7-0.3liby2util-2.11.7-0.3.i586.rpm
openSUSE9.3i586liby2util-devel< 2.11.7-0.3liby2util-devel-2.11.7-0.3.i586.rpm
openSUSE10.0ppcliby2util< 2.12.9-0.3liby2util-2.12.9-0.3.ppc.rpm
openSUSE9.3i586gpg< 1.4.0-4.2gpg-1.4.0-4.2.i586.rpm
openSUSE10.0ppcliby2util-devel< 2.12.9-0.3liby2util-devel-2.12.9-0.3.ppc.rpm
openSUSE9.3x86_64liby2util< 2.11.7-0.3liby2util-2.11.7-0.3.x86_64.rpm
openSUSE9.3x86_64liby2util-devel< 2.11.7-0.3liby2util-devel-2.11.7-0.3.x86_64.rpm
openSUSE10.0x86_64liby2util-devel< 2.12.9-0.3liby2util-devel-2.12.9-0.3.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
openSUSE	10.0	i586	gpg	< 1.4.2-5.2	gpg-1.4.2-5.2.i586.rpm
openSUSE	10.0	i586	liby2util	< 2.12.9-0.3	liby2util-2.12.9-0.3.i586.rpm
openSUSE	9.3	i586	liby2util	< 2.11.7-0.3	liby2util-2.11.7-0.3.i586.rpm
openSUSE	9.3	i586	liby2util-devel	< 2.11.7-0.3	liby2util-devel-2.11.7-0.3.i586.rpm
openSUSE	10.0	ppc	liby2util	< 2.12.9-0.3	liby2util-2.12.9-0.3.ppc.rpm
openSUSE	9.3	i586	gpg	< 1.4.0-4.2	gpg-1.4.0-4.2.i586.rpm
openSUSE	10.0	ppc	liby2util-devel	< 2.12.9-0.3	liby2util-devel-2.12.9-0.3.ppc.rpm
openSUSE	9.3	x86_64	liby2util	< 2.11.7-0.3	liby2util-2.11.7-0.3.x86_64.rpm
openSUSE	9.3	x86_64	liby2util-devel	< 2.11.7-0.3	liby2util-devel-2.11.7-0.3.x86_64.rpm
openSUSE	10.0	x86_64	liby2util-devel	< 2.12.9-0.3	liby2util-devel-2.12.9-0.3.x86_64.rpm