Vulnerability Name:

CVE-2012-6085 (CCN-80990)

Assigned:2012-12-29
Published:2012-12-29
Updated:2023-02-13
Summary:The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P)
4.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
4.3 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.2 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-20
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2012-6085

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: RHSA-2013-1458
Moderate: gnupg security update

Source: CCN
Type: RHSA-2013-1459
Moderate: gnupg2 security update

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: SA56926
Avaya Call Management System (CMS) Security Issue and Two Vulnerabilities

Source: DEBIAN
Type: DSA-2601
gnupg2 -- missing input sanitation

Source: CCN
Type: GnuPG Web Site
The GNU Privacy Guard

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: BID-57102
GnuPG CVE-2012-6085 Multiple Remote Memory Corruption Vulnerabilities

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: Exploit
secalert@redhat.com

Source: CCN
Type: Red Hat Bugzilla Bug 891142
CVE-2012-6085 GnuPG: read_block() corrupt key input validation

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: RHSA-2013-1459
gnupg2 security update

Source: CCN
Type: RHSA-2013-1806
samba and samba3x security update

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: XF
Type: UNKNOWN
gnupg-public-keys-code-exec(80990)

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*
    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*
    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*
    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*
    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*
    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*
    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gnupg:gnupg:1.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:gnupg:gnupg:1.4.10:*:*:*:*:*:*:*
  • OR cpe:/a:gnupg:gnupg:1.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnupg:gnupg:1.4.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnupg:gnupg:1.4.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnupg:gnupg:1.4.8:*:*:*:*:*:*:*
  • AND
  • cpe:/a:avaya:call_management_system_server:-:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20126085
    V
    		CVE-2012-6085
    2022-05-20
    oval:org.opensuse.security:def:33064
    P
    		Security update for log4j (Important)
    2021-12-17
    oval:org.opensuse.security:def:32216
    P
    		Security update for MozillaFirefox (Important)
    2021-11-17
    oval:org.opensuse.security:def:26115
    P
    		Security update for libesmtp (Important)
    2021-09-02
    oval:org.opensuse.security:def:36140
    P
    		gpg2-2.0.9-25.33.39.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42547
    P
    		gpg2-2.0.9-25.33.39.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:31618
    P
    		Security update for avahi (Important)
    2021-06-03
    oval:org.opensuse.security:def:31607
    P
    		Security update for qemu (Important)
    2021-04-16
    oval:org.opensuse.security:def:31606
    P
    		Security update for clamav (Important)
    2021-04-14
    oval:org.opensuse.security:def:32060
    P
    		Security update for the Linux Kernel (Live Patch 32 for SLE 12 SP3) (Important)
    2021-04-07
    oval:org.opensuse.security:def:33103
    P
    		Security update for ovmf (Moderate)
    2021-03-29
    oval:org.opensuse.security:def:32272
    P
    		Security update for python (Moderate)
    2021-03-16
    oval:org.opensuse.security:def:31692
    P
    		Security update for python3 (Important)
    2021-02-08
    oval:org.opensuse.security:def:26031
    P
    		Security update for php74 (Moderate)
    2021-01-14
    oval:org.opensuse.security:def:27138
    P
    		gpg2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32360
    P
    		Security update for strongswan (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26266
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31824
    P
    		Security update for bash (Low)
    2020-12-01
    oval:org.opensuse.security:def:25690
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:32426
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:26368
    P
    		Security update for irssi (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31973
    P
    		Security update for jakarta-taglibs-standard (Important)
    2020-12-01
    oval:org.opensuse.security:def:25765
    P
    		Security update for Adobe Flash Player (Important)
    2020-12-01
    oval:org.opensuse.security:def:26421
    P
    		Security update for hdf5 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25974
    P
    		Security update for gimp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27103
    P
    		curl on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32321
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:25689
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:32382
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26319
    P
    		Security update for kde-cli-tools5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31916
    P
    		Security update for gd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25701
    P
    		Security update for libexif (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26407
    P
    		Security update for libmad (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25893
    P
    		Security update for gstreamer-0_10-plugins-base (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26465
    P
    		Security update for enigmail (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:26022
    P
    		SUSE-SU-2013:1061-1 -- Security update for gpg
    2014-09-08
    oval:org.mitre.oval:def:25232
    P
    		SUSE-SU-2013:1058-2 -- Security update for gpg2
    2014-09-08
    oval:org.mitre.oval:def:25338
    P
    		SUSE-SU-2014:0750-1 -- Security update for gpg2
    2014-09-08
    oval:org.mitre.oval:def:24793
    P
    		SUSE-SU-2013:1578-1 -- Security update for gpg
    2014-09-08
    oval:org.mitre.oval:def:25751
    P
    		SUSE-SU-2013:1577-1 -- Security update for gpg
    2014-09-08
    oval:org.mitre.oval:def:25073
    P
    		SUSE-SU-2013:1058-1 -- Security update for gpg2
    2014-09-08
    oval:org.mitre.oval:def:17831
    P
    		USN-1682-1 -- gnupg, gnupg2 vulnerability
    2014-06-30
    oval:org.mitre.oval:def:18341
    P
    		DSA-2601-1 gnupg - missing input sanitation
    2014-06-23
    oval:org.mitre.oval:def:23451
    P
    		ELSA-2013:1458: gnupg security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:23894
    P
    		ELSA-2013:1459: gnupg2 security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:20690
    P
    		RHSA-2013:1459: gnupg2 security update (Moderate)
    2014-02-17
    oval:org.mitre.oval:def:20833
    P
    		RHSA-2013:1458: gnupg security update (Moderate)
    2014-02-17
    oval:com.redhat.rhsa:def:20131458
    P
    		RHSA-2013:1458: gnupg security update (Moderate)
    2013-10-24
    oval:com.redhat.rhsa:def:20131459
    P
    		RHSA-2013:1459: gnupg2 security update (Moderate)
    2013-10-24
    oval:com.ubuntu.precise:def:20126085000
    V
    		CVE-2012-6085 on Ubuntu 12.04 LTS (precise) - medium.
    2013-01-23
    BACK
    gnupg gnupg 1.4.0
    gnupg gnupg 1.4.10
    gnupg gnupg 1.4.2
    gnupg gnupg 1.4.4
    gnupg gnupg 1.4.5
    gnupg gnupg 1.4.8
    avaya call management system server -
    redhat enterprise linux 5
    redhat enterprise linux 5
    redhat enterprise linux 6
    redhat enterprise linux 6
    redhat enterprise linux desktop 6
    redhat enterprise linux hpc node 6