The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade gnupg1Upgrade gnupg | Aug 30, 2017 | Apr 22, 2015 |
| Debian | — | Upgrade gnupg2Upgrade gnupg | Jul 30, 2024 | Nov 20, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade gnupg2 | Nov 3, 2020 | Nov 20, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade gnupg2 | Sep 28, 2020 | Nov 20, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade gnupg2 | Feb 24, 2020 | Nov 20, 2019 |
| Oracle Solaris | — | Upgrade crypto/gnupg to version 2.0.27-0.175.2.13.0.3.0 on Solaris 11.2Upgrade security/pinentry to version 0.7.6-0.175.2.13.0.3.0 on Solaris 11.2Upgrade library/security/libksba to version 1.3.2-0.175.2.13.0.3.0 on Solaris 11.2Upgrade library/security/libassuan to version 2.2.0-0.175.2.13.0.3.0 on Solaris 11.2 | May 29, 2017 | May 29, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 20, 2019 |
| Suse | — | Upgrade gpg2-langUpgrade gpg2 | Dec 18, 2015 | Apr 1, 2015 |
| Ubuntu | — | Upgrade gnupgUpgrade gnupg2 | Nov 8, 2024 | Nov 20, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub