Ubuntu Security Notice 2258-1 - Jean-Rene Reinhard, Olivier Levillain and Florian Maury discovered that GnuPG incorrectly handled certain OpenPGP messages. If a user or automated system were tricked into processing a specially-crafted message, GnuPG could consume resources, resulting in a denial of service.
64ebbb4d63462023d548da35764df9fab01791f66fe49abd999b1c7d07f42781
============================================================================
Ubuntu Security Notice USN-2258-1
June 26, 2014
gnupg, gnupg2 vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
GnuPG could be made to hang if it processed a specially crafted message.
Software Description:
- gnupg: GNU privacy guard - a free PGP replacement
- gnupg2: GNU privacy guard - a free PGP replacement
Details:
Jean-Ren=C3=A9 Reinhard, Olivier Levillain and Florian Maury discovered that
GnuPG incorrectly handled certain OpenPGP messages. If a user or automated
system were tricked into processing a specially-crafted message, GnuPG
could consume resources, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
gnupg 1.4.16-1ubuntu2.1
gnupg2 2.0.22-3ubuntu1.1
Ubuntu 13.10:
gnupg 1.4.14-1ubuntu2.2
gnupg2 2.0.20-1ubuntu3.1
Ubuntu 12.04 LTS:
gnupg 1.4.11-3ubuntu2.6
gnupg2 2.0.17-2ubuntu2.12.04.4
Ubuntu 10.04 LTS:
gnupg 1.4.10-2ubuntu1.6
gnupg2 2.0.14-1ubuntu1.7
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2258-1
CVE-2014-4617
Package Information:
https://launchpad.net/ubuntu/+source/gnupg/1.4.16-1ubuntu2.1
https://launchpad.net/ubuntu/+source/gnupg2/2.0.22-3ubuntu1.1
https://launchpad.net/ubuntu/+source/gnupg/1.4.14-1ubuntu2.2
https://launchpad.net/ubuntu/+source/gnupg2/2.0.20-1ubuntu3.1
https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu2.6
https://launchpad.net/ubuntu/+source/gnupg2/2.0.17-2ubuntu2.12.04.4
https://launchpad.net/ubuntu/+source/gnupg/1.4.10-2ubuntu1.6
https://launchpad.net/ubuntu/+source/gnupg2/2.0.14-1ubuntu1.7