A use after free flaw was found in the way GnuPG 2.0 verified signature
and / or imported a certificate with many Subject Alternate Names. A remote
attacker could provide a specially-crafted certificate file and trick the
local user into verifying / importing it, which could lead to arbitrary
code execution with the privileges of the user running the gpgsm executable.
Affected versions (from ):
* The bug exists in all versions of GnuPG including the recently
released GnuPG 2.0.16.
* GPG (i.e. OpenPGP) is NOT affected.
* GnuPG 1.x is NOT affected because it does not come with
the GPGSM tool.
Upstream patch (from , 'Solution part'):
Apply the following patch. The patch is required for all GnuPG
versions < 2.0.17. It applies to 2.0.16 but should apply to many
older versions as well.
--- kbx/keybox-blob.c (revision 5367)
+++ kbx/keybox-blob.c (working copy)
@@ -898,6 +898,7 @@
rc = gpg_error_from_syserror ();
+ names = tmp;
names[blob->nuids++] = p;
if (!i && (p=x509_email_kludge (p)))
This issue did NOT affect the versions of the gnupg package, as shipped
with Red Hat Enterprise Linux 3, 4, and 5, as they did not include
the GPGSM tool.
This issue affects the version of the gnupg v2.0 package, as shipped
with Red Hat Enterprise Linux 5.
This issue has been already addressed in the current versions of
the gnupg2.0 package, as present in Fedora -testing repository
gnupg2-2.0.14-4.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2010:0603 https://rhn.redhat.com/errata/RHSA-2010-0603.html