Ubuntu 13.10: 2059-1 Critical: GnuPG Information Exposure

ubuntu

December 18, 2013

GnuPG could expose sensitive information when performing decryption.

Summary

GnuPG could expose sensitive information when performing decryption.

Software Description:

- gnupg: GNU privacy guard - a free PGP replacement

Details:

Daniel Genkin, Adi Shamir, and Eran Tromer discovered that GnuPG was

susceptible to an adaptive chosen ciphertext attack via acoustic

emanations. A local attacker could use this attack to possibly recover

private keys.

Topics Covered

security advisory gnupg critical information exposure ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  gnupg                           1.4.14-1ubuntu2.1

Ubuntu 13.04:
  gnupg                           1.4.12-7ubuntu1.3

Ubuntu 12.10:
  gnupg                           1.4.11-3ubuntu4.4

Ubuntu 12.04 LTS:
  gnupg                           1.4.11-3ubuntu2.5

Ubuntu 10.04 LTS:
  gnupg                           1.4.10-2ubuntu1.5

In general, a standard system update will make all the necessary changes.