CVE-2006-3082

23Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendepss 7.3%

da publicação à arma1 dias

Publicada no NVD19 de jun.

1ª PoC+1d

probabilidade de exploração

7.3%top 6% das CVEs

exploração observada

nãonenhuma fonte reporta

1 exploit(s) público(s)

parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option.

Produtos afetados

n/a · n/a

PoCs públicas encontradas — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/28077

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Referências

ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&r1=4141&r2=4157 http://seclists.org/lists/fulldisclosure/2006/May/0774.html http://seclists.org/lists/fulldisclosure/2006/May/0782.html http://seclists.org/lists/fulldisclosure/2006/May/0789.html http://secunia.com/advisories/20783 http://secunia.com/advisories/20801 http://secunia.com/advisories/20811 http://secunia.com/advisories/20829 http://secunia.com/advisories/20881 http://secunia.com/advisories/20899 http://secunia.com/advisories/20968