Skip to contentSkip to conversation

gnupg: security bump to version 1.4.18

PATCH New Gustavo Zacarias 2 participants 2 messages Jul 17, 2014

lore
Share & tools
lore

Gustavo Zacarias

author
#0 lore raw

PATCH 1/1 gnupg: security bump to version 1.4.18

Fixes CVE-2014-4617 (The do_uncompress function in g10/compress.c allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Signed-off-by Gustavo Zacarias <[email protected]>
---
 package/gnupg/gnupg.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
package/gnupg/gnupg.mk +1 -1
index 4c96967..fca6d51 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-GNUPG_VERSION = 1.4.17
+GNUPG_VERSION = 1.4.18
 GNUPG_SOURCE = gnupg-$(GNUPG_VERSION).tar.bz2
 GNUPG_SITE = ftp://ftp.gnupg.org/gcrypt/gnupg
 GNUPG_LICENSE = GPLv3+
Signature · 1 line
1.8.5.5
Applied
#1 lore raw

PATCH 1/1 gnupg: security bump to version 1.4.18

Dear Gustavo Zacarias,

Quoted 9 lines · Gustavo Zacarias

Fixes CVE-2014-4617 (The do_uncompress function in g10/compress.c allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Signed-off-by Gustavo Zacarias <[email protected]>
---
 package/gnupg/gnupg.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Applied, thanks.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com