CVE-2015-1606

NameCVE-2015-1606
Descriptionuse after free resulting from failure to skip invalid packets
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-175-1, DSA-3184-1
Debian Bugs778577, 778652

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gnupg (PTS)wheezy1.4.12-7+deb7u7fixed
wheezy (security)1.4.12-7+deb7u9fixed
jessie1.4.18-7+deb8u3fixed
jessie (security)1.4.18-7+deb8u4fixed
gnupg2 (PTS)wheezy, wheezy (security)2.0.19-2+deb7u2vulnerable
jessie2.0.26-6+deb8u1fixed
stretch2.1.18-8~deb9u1fixed
buster2.2.1-2fixed
sid2.2.1-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gnupgsource(unstable)1.4.18-7778652
gnupgsourcesqueeze1.4.10-4+squeeze7DLA-175-1
gnupgsourcewheezy1.4.12-7+deb7u7DSA-3184-1
gnupg2source(unstable)2.0.26-5778577
gnupg2sourceexperimental2.1.2-1

Notes

[wheezy] - gnupg2 <no-dsa> (Minor issue)
[squeeze] - gnupg2 <no-dsa> (Minor issue)
[squeeze] - gnupg <no-dsa> (Minor issue)
https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=f0f71a721ccd7ab9e40b8b6b028b59632c0cc648

Search for package or bug name: Reporting problems