CVE-2014-9087: Integer Underflow
Published Dec 1, 2014
·Updated
Integer underflow in the ksbaoidtostr function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.
Affected Software
10 affected components
Mageia Mageia=3.0
Mageia Mageia=4.0
Debian Debian Linux=7.0
Debian Debian Linux=8.0
gnupg Libksba<1.3.2
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=14.10
gnupg GnuPG=2.1.0
gnupg GnuPG=2.1.0-beta1
Remediation
Patch Available
Event History
Dec 1, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9087?
CVE-2014-9087 has a medium severity level due to its potential to cause a denial of service.
2
How do I fix CVE-2014-9087?
To fix CVE-2014-9087, you should upgrade Libksba to version 1.3.2 or later.
3
Which software is affected by CVE-2014-9087?
CVE-2014-9087 affects Libksba versions prior to 1.3.2, as well as various distributions like Debian and Ubuntu.
4
What kind of attacks can CVE-2014-9087 facilitate?
CVE-2014-9087 enables remote attackers to crash systems via crafted S/MIME messages or ECC-based OpenPGP data.
5
Is CVE-2014-9087 still a risk for supported systems?
CVE-2014-9087 remains a risk for systems not updated to the patched version of Libksba.