MGASA-2013-0003
| Date: | January 5th, 2013 |
| Affected releases: | 2 |
Description:
Updated gnupg and gnupg2 packages fix security vulnerability:
Versions of GnuPG <= 1.4.12 and GnuPG2 <= 2.0.19 are vulnerable to memory
access violations and public keyring database corruption when importing
public keys that have been manipulated. An OpenPGP key can be fuzzed in
such a way that gpg segfaults (or has other memory access violations)
when importing the key (CVE-2012-6085).
Updated Packages:
gnupg-1.4.12-1.1.mga2
gnupg2-2.0.18-1.2.mga2
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6085
https://bugs.g10code.com/gnupg/issue1455
https://bugzilla.redhat.com/show_bug.cgi?id=891142
http://www.mandriva.com/en/support/security/advisories/?dis=2011&name=MDVSA-2013:001
https://bugs.mageia.org/show_bug.cgi?id=8572
