← back
CVE-2006-3082

CVE-2006-3082

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 7.3%
from disclosure to weapon1 days
Published on NVDJun 19
1st PoC+1d
exploitation probability
7.3%top 6% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option.
Affected products
n/a · n/a
public PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/28077
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
ftp://patches.sgi.com/support/free/security/advisories/20060701-01-Uhttp://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&r1=4141&r2=4157http://seclists.org/lists/fulldisclosure/2006/May/0774.htmlhttp://seclists.org/lists/fulldisclosure/2006/May/0782.htmlhttp://seclists.org/lists/fulldisclosure/2006/May/0789.htmlhttp://secunia.com/advisories/20783http://secunia.com/advisories/20801http://secunia.com/advisories/20811http://secunia.com/advisories/20829http://secunia.com/advisories/20881http://secunia.com/advisories/20899http://secunia.com/advisories/20968