CVE-2008-1530 GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which trigge...
HighCVSS 9.3
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GnuPG | = 1.4.8 | No fix listed |
| GnuPG | = 2.0.8 | No fix listed |
| debian/gnupg2(Debian:12) | < 2.0.9-1 | 2.0.9-1 |
| debian/gnupg2(Debian:13) | < 2.0.9-1 | 2.0.9-1 |
| debian/gnupg2(Debian:14) | < 2.0.9-1 | 2.0.9-1 |
References
- [Announce] 20080326 GnuPG 1.4.9 released mailing-list
- 29568 third-party-advisory vendor-advisory
- www.ocert.org
- 28487 vdb-entry
- ADV-2008-1056 vdb-entry
- bugs.g10code.com
- bugs.gentoo.org
- gnupg-keys-code-execution(41547) vdb-entry
- Debian Security Tracker CVE-2008-1530 vendor-advisory
- bugs.debian.org issue-tracking