CVSS: 9.8EPSS: 1%CPEs: 5EXPL: 2CVE-2022-3515 – GnuPG libksba CRL File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-3515
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GnuPG libksba. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of CRL files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. • https://access.redhat.com/security/cve/CVE-2022-3515 https://bugzilla.redhat.com/show_bug.cgi?id=2135610 https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b https://security.netapp.com/advisory/ntap-20230706-0008 https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2020-25125
https://notcve.org/view.php?id=CVE-2020-25125
GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version. GnuPG versiones 2.2.21 y 2.2.22 (y Gpg4win versión 3.1.12), presenta un desbordamiento de la matriz, conllevando a un bloqueo o posiblemente otro impacto no especificado, cuando una víctima importa la clave OpenPGP de un atacante, y esta clave contiene preferencias AEAD. • http://www.openwall.com/lists/oss-security/2020/09/03/4 http://www.openwall.com/lists/oss-security/2020/09/03/5 https://bugzilla.opensuse.org/show_bug.cgi?id=1176034 https://dev.gnupg.org/T5050 https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 4.3EPSS: 3%CPEs: 2EXPL: 3CVE-2009-3805 – GPG2/Kleopatra 2.0.11 - Malformed Certificate
https://notcve.org/view.php?id=CVE-2009-3805
gpg2.exe in Gpg4win 2.0.1, as used in KDE Kleopatra 2.0.11, allows remote attackers to cause a denial of service (application crash) via a long certificate signature. gpg2.exe en Gpg4win v2.0.1, como el usado en KDE Kleopatra v2.0.11, permite a atacantes remotos causar una denegación de servicio (caída de programa) a través de una firma certificada larga. • https://www.exploit-db.com/exploits/9884 http://www.packetstormsecurity.com/0910-exploits/gpg2kleo-dos.txt http://www.securityfocus.com/bid/36781 https://exchange.xforce.ibmcloud.com/vulnerabilities/53908 •
CVSS: 10.0EPSS: 5%CPEs: 32EXPL: 0CVE-2006-6235
https://notcve.org/view.php?id=CVE-2006-6235
A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory. Una vulnerabilidad de "escritura en pila" en GnuPG (gpg) 1.x anterior a la 1.4.6, 2.x anterior a la 2.0.2 y 1.9.0 hasta la 1.9.95 permite a atacantes ejecutar código de su elección mediante paquetes OpenPGP artesanales que provocan que GnuPG haga referencia a un puntero a función que está en memoria (en la pila) que ya ha sido liberada. • ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html http://secunia.com/advisories/23245 http://secunia.com/advisories/23250 http://secunia.com/advisories/23255 http://secunia.com/advisories/23259 http://secunia.com/advisories/23269 http://secunia.com/advisories/23284 http://secunia.com/advisories/23290 http://secunia. •