Ubuntu 12.10 USN-1682-1 Critical GnuPG Keyring Corruption Risk

ubuntu

January 9, 2013

GnuPG could be made to corrupt the keyring if it imported a specially crafted key.

Summary

GnuPG could be made to corrupt the keyring if it imported a specially

crafted key.

Software Description:

- gnupg: GNU privacy guard - a free PGP replacement

- gnupg2: GNU privacy guard - a free PGP replacement

Details:

KB Sriram discovered that GnuPG incorrectly handled certain malformed keys.

If a user or automated system were tricked into importing a malformed key,

the GnuPG keyring could become corrupted.

Topics Covered

security advisory gnupg critical ubuntu keyring

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  gnupg                           1.4.11-3ubuntu4.1
  gnupg2                          2.0.17-2ubuntu3.1

Ubuntu 12.04 LTS:
  gnupg                           1.4.11-3ubuntu2.2
  gnupg2                          2.0.17-2ubuntu2.12.04.2

Ubuntu 11.10:
  gnupg                           1.4.11-3ubuntu1.11.10.2
  gnupg2                          2.0.17-2ubuntu2.11.10.2

Ubuntu 10.04 LTS:
  gnupg                           1.4.10-2ubuntu1.2
  gnupg2                          2.0.14-1ubuntu1.5

Ubuntu 8.04 LTS:
  gnupg                           1.4.6-2ubuntu5.2

In general, a standard system update will make all the necessary changes.