oss-sec mailing list archives
Re: CVE Request(s): GnuPG 2/GPG2
From: Joshua Rogers <oss () internot info>
Date: Tue, 06 Jan 2015 21:35:29 +1100
On 06/01/15 04:42, cve-assign () mitre org wrote:
What is the attack scenario for these double frees? It is not immediately clear whether there is a role for an attacker who is not the GnuPG user.
Here is the response from Werner: ---
Double free in scd/command.c: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773471
Could be triggered due to an out of memory condition or a wrong use of a functions. Hard to exploit I guess.
Double free in sm/minip12.c: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773472
That may happen if iconv_open fails. Memory error or utf-8 not available. Note that the buffer is allocated in out secure memory and thus the gcry_free() zeroes the memory. I can't see how this can be exploted but I am not an expert for this. --- Hopefully that answers the question, Thanks, -- -- Joshua Rogers <https://internot.info/>
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Re: CVE Request(s): GnuPG 2/GPG2 cve-assign (Jan 05)
- Re: CVE Request(s): GnuPG 2/GPG2 Joshua Rogers (Jan 06)
- <Possible follow-ups>
- Re: Re: CVE Request(s): GnuPG 2/GPG2 Moritz Muehlenhoff (Jan 05)