Debian: New GnuPG2 packages fix denial of service

    Date21 Jul 2006
    CategoryDebian
    4180
    Posted ByLinuxSecurity Advisories
    Evgeny Legerov discovered that gnupg, the GNU privacy guard, a free PGP replacement contains an integer overflow that can cause a segmentation fault and possibly overwrite memory via a large user ID strings.
    - --------------------------------------------------------------------------
    Debian Security Advisory DSA 1115-1                    This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                             Martin Schulze
    July 21st, 2006                         http://www.debian.org/security/faq
    - --------------------------------------------------------------------------
    
    Package        : gnupg2
    Vulnerability  : integer overflow
    Problem type   : local (remote)
    Debian-specific: no
    CVE ID         : CVE-2006-3082
    
    Evgeny Legerov discovered that gnupg, the GNU privacy guard, a free
    PGP replacement contains an integer overflow that can cause a
    segmentation fault and possibly overwrite memory via a large user ID
    strings.
    
    For the stable distribution (sarge) this problem has been fixed in
    version 1.4.1-1.sarge4 of GnuPG and in version 1.9.15-6sarge1 of GnuPG2.
    
    For the unstable distribution (sid) this problem has been fixed in
    version 1.4.3-2 of GnuPG, a fix for GnuPG2 is pending.
    
    We recommend that you upgrade your gnupg package.
    
    
    Upgrade Instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given at the end of this advisory:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    
    Debian GNU/Linux 3.1 alias sarge
    - --------------------------------
    
      Source archives:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1.dsc
          Size/MD5 checksum:      854 d7f54b50b8c569566cfe0b865ec20323
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1.diff.gz
          Size/MD5 checksum:  1859944 fbb56cbacfb82fb5666646bed3dd2944
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15.orig.tar.gz
          Size/MD5 checksum:  5454978 ee3885e2c74a9c1ae539d6f12091c30b
    
      Alpha architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_alpha.deb
          Size/MD5 checksum:   112318 e806b0cedb8ed0914e6e035d042acdd0
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_alpha.deb
          Size/MD5 checksum:   886212 1763f96899b22f286232871b9b085ed6
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_alpha.deb
          Size/MD5 checksum:   453430 6dfaaea879aa17fc0dd623889a983507
    
      AMD64 architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_amd64.deb
          Size/MD5 checksum:    98464 cafa5d36dbcb21d795b6372c8293d6f8
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_amd64.deb
          Size/MD5 checksum:   774560 96bf1b958e560fe17d632c26c38d9efc
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_amd64.deb
          Size/MD5 checksum:   385700 4b2b4ddc50eaf51b5701d7d47e1c9b3c
    
      ARM architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_arm.deb
          Size/MD5 checksum:    87318 d72f15b0cef0d127af34819d3ca5f14a
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_arm.deb
          Size/MD5 checksum:   712814 22e92a7324e81906493140954172d5bf
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_arm.deb
          Size/MD5 checksum:   339666 1d23cfebbe8e6c7396aeff77eb9c8820
    
      Intel IA-32 architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_i386.deb
          Size/MD5 checksum:    90042 0e930e3cdcb129f1a442299f4d0540e3
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_i386.deb
          Size/MD5 checksum:   731422 9a9f643a1dbc83c6b3f3dd9bfffe0a52
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_i386.deb
          Size/MD5 checksum:   351906 8282625e16ac625f67e38f39ff107652
    
      Intel IA-64 architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_ia64.deb
          Size/MD5 checksum:   130298 2eedf4cf8372007857433ca639524d9b
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_ia64.deb
          Size/MD5 checksum:  1026226 e782e4b34a5b92e8096d2654b2cc5a4c
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_ia64.deb
          Size/MD5 checksum:   539910 20467693f439c077a70084dc3a97013c
    
      HP Precision architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_hppa.deb
          Size/MD5 checksum:   100568 8196f49a542cafff2df799dcf01aec82
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_hppa.deb
          Size/MD5 checksum:   794658 51ccc9c508247dd4f420f6cf6573aac2
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_hppa.deb
          Size/MD5 checksum:   393956 18059987ad743bf9af518acc89657417
    
      Motorola 680x0 architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_m68k.deb
          Size/MD5 checksum:    82140 1fba5cdda78f5f5deca9627a85c04c57
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_m68k.deb
          Size/MD5 checksum:   669532 92a8750d7d53e87a6400dc0dbb3d09d6
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_m68k.deb
          Size/MD5 checksum:   311950 f1a33648d91e20d5b844f5c7f7da57a9
    
      Big endian MIPS architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_mips.deb
          Size/MD5 checksum:   100504 7d791fe14e51c77d2332f56a381cf271
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_mips.deb
          Size/MD5 checksum:   788588 bdec126011eee7c8d8d72eca6cfdcdc4
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_mips.deb
          Size/MD5 checksum:   395058 655dc54c72b2c0179d10c47b2f5860dd
    
      Little endian MIPS architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_mipsel.deb
          Size/MD5 checksum:   100978 56b72587ce25c10b5dcc088a15909fe0
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_mipsel.deb
          Size/MD5 checksum:   790238 e607d5e8afa7a8302f53445617d0c8b8
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_mipsel.deb
          Size/MD5 checksum:   396254 470e2d93f2648e2cf6608324c1500d22
    
      PowerPC architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_powerpc.deb
          Size/MD5 checksum:    95574 d69613b8feaec3e719a6d41e01c6bbb0
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_powerpc.deb
          Size/MD5 checksum:   769188 bb1d47b585a6ba73ec3ab5733c2bd9e5
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_powerpc.deb
          Size/MD5 checksum:   377318 62c7a186f295f33911233ecbe59df6b3
    
      IBM S/390 architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_s390.deb
          Size/MD5 checksum:    98696 d105f1f4f8b7f622b2353e01bccf8f60
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_s390.deb
          Size/MD5 checksum:   766416 b697db437ddd9c6d66c18244b0730ef7
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_s390.deb
          Size/MD5 checksum:   384736 956245edec30fd206a7e63f58139937b
    
      Sun Sparc architecture:
    
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge1_sparc.deb
          Size/MD5 checksum:    89540 cbcc2a2dcc603baf6632446fcee75f6a
        http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge1_sparc.deb
          Size/MD5 checksum:   720868 97a6fd87caaf94c0d1ff3eb87f35b7cf
        http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge1_sparc.deb
          Size/MD5 checksum:   345146 51a1a825f01eff2085b2fddaa4394432
    
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"5","type":"x","order":"1","pct":55.56,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":33.33,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":11.11,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.