CVE-2010-2547
published 2010-08-05CVE-2010-2547: Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and…
PriorityP338high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
5.34%
91.7th percentile
Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | gnupg2 | < gnupg2 2.0.14-2 (bookworm) | gnupg2 2.0.14-2 (bookworm) |
| fedoraproject | fedora | — | — |
| gnupg | gnupg | 2.0.0 – 2.0.16 | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
osv8.1HIGH
vendor_debian8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jjg3-cx5h-88wm: Use-after-free vulnerability in kbx/keybox-blob
ghsa_unreviewed·2022-05-17
CVE-2010-2547 [MEDIUM] CWE-416 GHSA-jjg3-cx5h-88wm: Use-after-free vulnerability in kbx/keybox-blob
Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.
OSV
CVE-2010-2547: Use-after-free vulnerability in kbx/keybox-blob
osv·2010-08-05·CVSS 8.1
CVE-2010-2547 [HIGH] CVE-2010-2547: Use-after-free vulnerability in kbx/keybox-blob
Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.
Ubuntu
GnuPG2 vulnerability
vendor_ubuntu·2010-08-11
CVE-2010-2547 GnuPG2 vulnerability
Title: GnuPG2 vulnerability
It was discovered that GPGSM in GnuPG2 did not correctly handle
certificates with a large number of Subject Alternate Names. If a user or
automated system were tricked into processing a specially crafted
certificate, an attacker could cause a denial of service or execute
arbitrary code with privileges of the user invoking the program.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
2: use-after-free when importing certificate with many alternate names
vendor_redhat·2010-07-23·CVSS 8.1
CVE-2010-2547 [HIGH] CWE-416 2: use-after-free when importing certificate with many alternate names
2: use-after-free when importing certificate with many alternate names
Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.
Package: gnupg2 (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2010-2547: gnupg2 - Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through ...
vendor_debian·2010·CVSS 8.1
CVE-2010-2547 [HIGH] CVE-2010-2547: gnupg2 - Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through ...
Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.
Scope: local
bookworm: resolved (fixed in 2.0.14-2)
bullseye: resolved (fixed in 2.0.14-2)
forky: resolved (fixed in 2.0.14-2)
sid: resolved (fixed in 2.0.14-2)
trixie: resolved (fixed in 2.0.14-2)
No detection rules found.
No public exploits indexed.
http://lists.fedoraproject.org/pipermail/package-announce/2010-August/044935.htmlhttp://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.htmlhttp://secunia.com/advisories/38877http://secunia.com/advisories/40718http://secunia.com/advisories/40841http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.462008http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0076http://www.debian.org/security/2010/dsa-2076http://www.mandriva.com/security/advisories?name=MDVSA-2010:143http://www.securityfocus.com/bid/41945http://www.securitytracker.com/id?1024247http://www.vupen.com/english/advisories/2010/1931http://www.vupen.com/english/advisories/2010/1950http://www.vupen.com/english/advisories/2010/1988http://www.vupen.com/english/advisories/2010/2217http://www.vupen.com/english/advisories/2010/3125https://issues.rpath.com/browse/RPL-3229http://lists.fedoraproject.org/pipermail/package-announce/2010-August/044935.htmlhttp://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.htmlhttp://secunia.com/advisories/38877http://secunia.com/advisories/40718http://secunia.com/advisories/40841http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.462008http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0076http://www.debian.org/security/2010/dsa-2076http://www.mandriva.com/security/advisories?name=MDVSA-2010:143http://www.securityfocus.com/bid/41945http://www.securitytracker.com/id?1024247http://www.vupen.com/english/advisories/2010/1931http://www.vupen.com/english/advisories/2010/1950http://www.vupen.com/english/advisories/2010/1988http://www.vupen.com/english/advisories/2010/2217http://www.vupen.com/english/advisories/2010/3125https://issues.rpath.com/browse/RPL-3229
2010-08-05
Published