CVE-2003-0978 Format string vulnerability in gpgkeys_hkp (experimental HKP interface) for the GnuPG (gpg) client 1.2.3 and earlier, and 1.3.3 and earlier, allows remote attackers or a malicious keyserver to cause a...
HighCVSS 7.5
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in gpgkeys_hkp (experimental HKP interface) for the GnuPG (gpg) client 1.2.3 and earlier, and 1.3.3 and earlier, allows remote attackers or a malicious keyserver to cause a denial of service (crash) and possibly execute arbitrary code during key retrieval.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU privacy guard | = 1.2 | No fix listed |
| GNU privacy guard | = 1.2.1 | No fix listed |
| GNU privacy guard | = 1.2.2 | No fix listed |
| GNU privacy guard | = 1.2.2-rc1 | No fix listed |
| GNU privacy guard | = 1.2.3 | No fix listed |
| GNU privacy guard | = 1.3.3 | No fix listed |
References
- 20031203 GnuPG 1.2.3, 1.3.3 external HKP interface format string issue mailing-list
- SuSE-SA:2003:048 vendor-advisory
- www.s-quadra.com
- gnupg-gpgkeyshkp-format-string(13892) vdb-entry