diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index ae8e6cb89fa9..4fb71b6b2d77 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,37 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + gnupg -- AEAD key import overflow + + + gnupg + 2.2.21 + 2.2.23 + + + + +

Importing an OpenPGP key having a preference list for AEAD algorithms + will lead to an array overflow and thus often to a crash or other + undefined behaviour.

+ +

Importing an arbitrary key can often easily be triggered by an attacker + and thus triggering this bug. Exploiting the bug aside from crashes is + not trivial but likely possible for a dedicated attacker. The major + hurdle for an attacker is that only every second byte is under their + control with every first byte having a fixed value of 0x04.

+ + + + CVE-2020-25125 + https://dev.gnupg.org/T5050 + + + 2020-09-03 + + + FreeBSD -- dhclient heap overflow