CVE-2014-9087

NONE

Published Dec 1, 201411y ago · Modified Jun 17, 20262w ago

Published Dec 1, 2014 11y ago

Last Modified Jun 17, 2026 2w ago

Description

Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-191

Affected Products 10

Vendor	Product	Version	Range
mageia	mageia	3.0	any
mageia	mageia	4.0	any
debian	debian_linux	7.0	any
debian	debian_linux	8.0	any
gnupg	libksba	*	<1.3.2
canonical	ubuntu_linux	12.04	any
canonical	ubuntu_linux	14.04	any
canonical	ubuntu_linux	14.10	any
gnupg	gnupg	2.1.0	any
gnupg	gnupg	2.1.0	any

References 11

advisories.mageia.org http://advisories.mageia.org/MGASA-2014-0498.html

Third Party Advisory
lists.gnupg.org http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html

Mailing ListVendor Advisory
secunia.com http://secunia.com/advisories/60073

Third Party Advisory
secunia.com http://secunia.com/advisories/60189

Third Party Advisory
secunia.com http://secunia.com/advisories/60233

Third Party Advisory
debian.org http://www.debian.org/security/2014/dsa-3078

Third Party Advisory
mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2014:234

Not Applicable
mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2015:151

Not Applicable
securityfocus.com http://www.securityfocus.com/bid/71285

Third Party AdvisoryVDB Entry
ubuntu.com http://www.ubuntu.com/usn/USN-2427-1

PatchThird Party Advisory
blog.fuzzing-project.org https://blog.fuzzing-project.org/2-Buffer-overflow-and-other-minor-issues-in-GnuPG-and-libksba-TFPA-0012014.html

Third Party Advisory

Remediation

ubuntu.com http://www.ubuntu.com/usn/USN-2427-1

PatchThird Party Advisory