Bug 618156 (CVE-2010-2547)

A use after free flaw was found in the way GnuPG 2.0 verified signature
and / or imported a certificate with many Subject Alternate Names. A remote
attacker could provide a specially-crafted certificate file and trick the
local user into verifying / importing it, which could lead to arbitrary
code execution with the privileges of the user running the gpgsm executable.

References:
  [1] http://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.html
  [2] http://bugs.gentoo.org/show_bug.cgi?id=329587
  [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590122

CVE Request:
  [4] http://www.openwall.com/lists/oss-security/2010/07/23/4

Affected versions (from [1]):
  * The bug exists in all versions of GnuPG including the recently
    released GnuPG 2.0.16.

  * GPG (i.e. OpenPGP) is NOT affected.

  * GnuPG 1.x is NOT affected because it does not come with
    the GPGSM tool.

Upstream patch (from [1], 'Solution part'):

Apply the following patch.  The patch is required for all GnuPG
versions < 2.0.17.  It applies to 2.0.16 but should apply to many
older versions as well.


--- kbx/keybox-blob.c   (revision 5367)
+++ kbx/keybox-blob.c   (working copy)
@@ -898,6 +898,7 @@
               rc = gpg_error_from_syserror ();
               goto leave;
             }
+          names = tmp;
         }
       names[blob->nuids++] = p;
       if (!i && (p=x509_email_kludge (p)))