USN-970-1: GnuPG2 vulnerability

Releases

• Ubuntu 10.04
• Ubuntu 9.10
• Ubuntu 9.04
• Ubuntu 8.04

Packages

• gnupg2 -

Details

It was discovered that GPGSM in GnuPG2 did not correctly handle
certificates with a large number of Subject Alternate Names. If a user or
automated system were tricked into processing a specially crafted
certificate, an attacker could cause a denial of service or execute
arbitrary code with privileges of the user invoking the program.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.10

• gpgsm - 2.0.12-0ubuntu2.1

Ubuntu 9.04

• gpgsm - 2.0.9-3.1ubuntu0.1

Ubuntu 8.04

• gpgsm - 2.0.7-1ubuntu0.1

Ubuntu 10.04

• gpgsm - 2.0.14-1ubuntu1.2

In general, a standard system update will make all the necessary changes.

References

• CVE-2010-2547