CVE-2014-9087

Publication date 26 November 2014

Last updated 24 July 2024

Ubuntu priority

Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gnupg2	14.10 utopic	Not affected
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not affected
libksba	14.10 utopic	Fixed 1.3.0-3ubuntu0.14.10.1
	14.04 LTS trusty	Fixed 1.3.0-3ubuntu0.14.04.1
	12.04 LTS precise	Fixed 1.2.0-2ubuntu0.1
	10.04 LTS lucid	Ignored end of life

Notes

mdeslaur

affects gnupg2 2.1 only

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libksba	Upstream: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=f715b9e156dfa99ae829fc694e5a0abd23ef97d7

References

Related Ubuntu Security Notices (USN)