CVE-2014-4617

Publication date 26 June 2014

Last updated 24 July 2024

Ubuntu priority

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gnupg	14.04 LTS trusty	Fixed 1.4.16-1ubuntu2.1
	13.10 saucy	Fixed 1.4.14-1ubuntu2.2
	12.04 LTS precise	Fixed 1.4.11-3ubuntu2.6
	10.04 LTS lucid	Fixed 1.4.10-2ubuntu1.6
gnupg2	14.04 LTS trusty	Fixed 2.0.22-3ubuntu1.1
	13.10 saucy	Fixed 2.0.20-1ubuntu3.1
	12.04 LTS precise	Fixed 2.0.17-2ubuntu2.12.04.4
	10.04 LTS lucid	Ignored

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
gnupg	Upstream: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commitdiff;h=11fdfcf82bd8
gnupg2	Upstream: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commitdiff;h=014b2103fcb1

References

Related Ubuntu Security Notices (USN)

USN-2258-1
GnuPG vulnerability
26 June 2014

CVE-2014-4617

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references