CVE-2014-4617

Publication date 26 June 2014

Last updated 24 July 2024

Ubuntu priority

Description

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gnupg	14.04 LTS trusty	Fixed in 1.4.16-1ubuntu2.1
	13.10 saucy	Fixed in 1.4.14-1ubuntu2.2
	12.04 LTS precise	Fixed in 1.4.11-3ubuntu2.6
	10.04 LTS lucid	Fixed in 1.4.10-2ubuntu1.6
gnupg2	14.04 LTS trusty	Fixed in 2.0.22-3ubuntu1.1
	13.10 saucy	Fixed in 2.0.20-1ubuntu3.1
	12.04 LTS precise	Fixed in 2.0.17-2ubuntu2.12.04.4
	10.04 LTS lucid	Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
gnupg	Upstream: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commitdiff;h=11fdfcf82bd8
gnupg2	Upstream: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commitdiff;h=014b2103fcb1

References

Related Ubuntu Security Notices (USN)

USN-2258-1
GnuPG vulnerability
26 June 2014