USN-2258-1: GnuPG vulnerability

Releases

• Ubuntu 14.04 ESM
• Ubuntu 13.10
• Ubuntu 12.04
• Ubuntu 10.04

Packages

• gnupg - GNU privacy guard - a free PGP replacement
• gnupg2 - GNU privacy guard - a free PGP replacement

Details

Jean-René Reinhard, Olivier Levillain and Florian Maury discovered that
GnuPG incorrectly handled certain OpenPGP messages. If a user or automated
system were tricked into processing a specially-crafted message, GnuPG
could consume resources, resulting in a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04

• gnupg - 1.4.16-1ubuntu2.1
• gnupg2 - 2.0.22-3ubuntu1.1

Ubuntu 13.10

• gnupg - 1.4.14-1ubuntu2.2
• gnupg2 - 2.0.20-1ubuntu3.1

Ubuntu 12.04

• gnupg - 1.4.11-3ubuntu2.6
• gnupg2 - 2.0.17-2ubuntu2.12.04.4

Ubuntu 10.04

• gnupg - 1.4.10-2ubuntu1.6
• gnupg2 - 2.0.14-1ubuntu1.7

In general, a standard system update will make all the necessary changes.

References

• CVE-2014-4617