CVE-2015-1607

Name of the Vulnerable Software and Affected Versions GnuPG versions 1.4.18 and earlier GnuPG versions 2.0.x prior to 2.0.27 GnuPG versions 2.1.x prior to 2.1.2

Description The issue is related to the improper handling of bitwise left-shifts in the keybox-search.c file, which can be exploited by remote attackers to cause a denial of service through a crafted keyring file. This is related to sign extensions and "memcpy with overlapping ranges."

Recommendations For GnuPG versions 1.4.18 and earlier, update to version 1.4.19 or later. For GnuPG versions 2.0.x prior to 2.0.27, update to version 2.0.27 or later. For GnuPG versions 2.1.x prior to 2.1.2, update to version 2.1.2 or later.