CVE-2015-1606

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-20 · updated 2026-06-17
Weakness: CWE-416

Description

The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.

Affected products

Debian Linux: 7.0, 8.0
GnuPG: before 2.1.2 — fixed in 2.1.2

How to fix

Upgrade to a fixed version: GnuPG 2.1.2. Check the vendor advisory for mitigations.

References

http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=f0f71a721ccd7ab9e40b8b6b028b59632c0cc648
http://www.debian.org/security/2015/dsa-3184
http://www.openwall.com/lists/oss-security/2015/02/13/14
http://www.openwall.com/lists/oss-security/2015/02/14/6
http://www.securitytracker.com/id/1031876
https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git%3Ba=commit%3Bh=f0f71a721ccd7ab9e40b8b6b028b59632c0cc648
http://www.debian.org/security/2015/dsa-3184
http://www.openwall.com/lists/oss-security/2015/02/13/14
http://www.openwall.com/lists/oss-security/2015/02/14/6
http://www.securitytracker.com/id/1031876
https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html

Get alerted when CVE-2015-1606 or the next vulnerability affects your stack