CVE-2013-4242

2013-07-2900:00:00

ubuntu.com

1.9 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.3%

JSON

GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and
possibly other products, allows local users to obtain private RSA keys via
a cache side-channel attack involving the L3 cache, aka Flush+Reload.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=717880>

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchgnupg< 1.4.10-2ubuntu1.3UNKNOWN
ubuntu12.04noarchgnupg< 1.4.11-3ubuntu2.3UNKNOWN
ubuntu12.10noarchgnupg< 1.4.11-3ubuntu4.2UNKNOWN
ubuntu13.04noarchgnupg< 1.4.12-7ubuntu1.1UNKNOWN
ubuntu10.04noarchlibgcrypt11< 1.4.4-5ubuntu2.2UNKNOWN
ubuntu12.04noarchlibgcrypt11< 1.5.0-3ubuntu0.2UNKNOWN
ubuntu12.10noarchlibgcrypt11< 1.5.0-3ubuntu1.1UNKNOWN
ubuntu13.04noarchlibgcrypt11< 1.5.0-3ubuntu2.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	gnupg	< 1.4.10-2ubuntu1.3	UNKNOWN
ubuntu	12.04	noarch	gnupg	< 1.4.11-3ubuntu2.3	UNKNOWN
ubuntu	12.10	noarch	gnupg	< 1.4.11-3ubuntu4.2	UNKNOWN
ubuntu	13.04	noarch	gnupg	< 1.4.12-7ubuntu1.1	UNKNOWN
ubuntu	10.04	noarch	libgcrypt11	< 1.4.4-5ubuntu2.2	UNKNOWN
ubuntu	12.04	noarch	libgcrypt11	< 1.5.0-3ubuntu0.2	UNKNOWN
ubuntu	12.10	noarch	libgcrypt11	< 1.5.0-3ubuntu1.1	UNKNOWN
ubuntu	13.04	noarch	libgcrypt11	< 1.5.0-3ubuntu2.2	UNKNOWN