CVE-2010-2547
Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names,…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 5.34% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- gnupg/gnupg · fedoraproject/fedora · debian/debian linux
- Source
- secalert@redhat.com
References
- http://lists.fedoraproject.org/pipermail/package-announce/2010-August/044935.htmlMailing List, Third Party Advisory
- http://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.htmlPatch, Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.htmlMailing List, Third Party Advisory
- http://secunia.com/advisories/38877Broken Link, Vendor Advisory
- http://secunia.com/advisories/40718Broken Link, Vendor Advisory
- http://secunia.com/advisories/40841Broken Link, Vendor Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.462008Broken Link
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0076Broken Link
- http://www.debian.org/security/2010/dsa-2076Mailing List, Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:143Broken Link
- http://www.securityfocus.com/bid/41945Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1024247Broken Link, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2010/1931Broken Link, Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1950Broken Link, Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1988Broken Link, Vendor Advisory
- http://www.vupen.com/english/advisories/2010/2217Broken Link
- http://www.vupen.com/english/advisories/2010/3125Broken Link
- https://issues.rpath.com/browse/RPL-3229Broken Link
- http://lists.fedoraproject.org/pipermail/package-announce/2010-August/044935.htmlMailing List, Third Party Advisory
- http://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.htmlPatch, Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.htmlMailing List, Third Party Advisory
- http://secunia.com/advisories/38877Broken Link, Vendor Advisory
- http://secunia.com/advisories/40718Broken Link, Vendor Advisory
- http://secunia.com/advisories/40841Broken Link, Vendor Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.462008Broken Link
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0076Broken Link
- http://www.debian.org/security/2010/dsa-2076Mailing List, Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:143Broken Link
- http://www.securityfocus.com/bid/41945Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1024247Broken Link, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.