[arch-security] [ASA-201604-11] pgpdump: denial of service
anthraxx at archlinux.org
Fri Apr 22 22:57:10 UTC 2016
Arch Linux Security Advisory ASA-201604-11
Date : 2016-04-22
CVE-ID : CVE-2016-4021
Package : pgpdump
Type : denial of service
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package pgpdump before version 0.30-1 is vulnerable to denial of
Upgrade to 0.30-1.
# pacman -Syu "pgpdump>=0.30-1"
The problem has been fixed upstream in version 0.30.
When pgpdump is run on specially crafted input, a denial of service
condition occurs. The program runs with 100% CPU usage for an indefinite
amount of time.
This can be abused in scenarios where users can supply input to pgpdump,
e.g. in http://www.pgpdump.net/.
A remote attacker is able to create a specially crafted input that is
leading to CPU resource consumption resulting in denial of service.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security