CVE-2012-6085

2012-12-3100:00:00

ubuntu.com

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

0.05 Low

EPSS

Percentile

92.8%

JSON

The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and
2.0.x through 2.0.19, when importing a key, allows remote attackers to
corrupt the public keyring database or cause a denial of service
(application crash) via a crafted length field of an OpenPGP packet.

Bugs

Notes

Author	Note
seth-arnold	reproducer key available from dropbox url

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchgnupg< 1.4.6-2ubuntu5.2UNKNOWN
ubuntu10.04noarchgnupg< 1.4.10-2ubuntu1.2UNKNOWN
ubuntu11.10noarchgnupg< 1.4.11-3ubuntu1.11.10.2UNKNOWN
ubuntu12.04noarchgnupg< 1.4.11-3ubuntu2.2UNKNOWN
ubuntu12.10noarchgnupg< 1.4.11-3ubuntu4.1UNKNOWN
ubuntu10.04noarchgnupg2< 2.0.14-1ubuntu1.5UNKNOWN
ubuntu11.10noarchgnupg2< 2.0.17-2ubuntu2.11.10.2UNKNOWN
ubuntu12.04noarchgnupg2< 2.0.17-2ubuntu2.12.04.2UNKNOWN
ubuntu12.10noarchgnupg2< 2.0.17-2ubuntu3.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	gnupg	< 1.4.6-2ubuntu5.2	UNKNOWN
ubuntu	10.04	noarch	gnupg	< 1.4.10-2ubuntu1.2	UNKNOWN
ubuntu	11.10	noarch	gnupg	< 1.4.11-3ubuntu1.11.10.2	UNKNOWN
ubuntu	12.04	noarch	gnupg	< 1.4.11-3ubuntu2.2	UNKNOWN
ubuntu	12.10	noarch	gnupg	< 1.4.11-3ubuntu4.1	UNKNOWN
ubuntu	10.04	noarch	gnupg2	< 2.0.14-1ubuntu1.5	UNKNOWN
ubuntu	11.10	noarch	gnupg2	< 2.0.17-2ubuntu2.11.10.2	UNKNOWN
ubuntu	12.04	noarch	gnupg2	< 2.0.17-2ubuntu2.12.04.2	UNKNOWN
ubuntu	12.10	noarch	gnupg2	< 2.0.17-2ubuntu3.1	UNKNOWN