Unrated severityNVD Advisory· Published Dec 1, 2014· Updated May 6, 2026
CVE-2014-9087
CVE-2014-9087
Description
Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.
Affected products
10cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
11- www.ubuntu.com/usn/USN-2427-1nvdPatchThird Party Advisory
- advisories.mageia.org/MGASA-2014-0498.htmlnvdThird Party Advisory
- lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.htmlnvdMailing ListVendor Advisory
- secunia.com/advisories/60073nvdThird Party Advisory
- secunia.com/advisories/60189nvdThird Party Advisory
- secunia.com/advisories/60233nvdThird Party Advisory
- www.debian.org/security/2014/dsa-3078nvdThird Party Advisory
- www.securityfocus.com/bid/71285nvdThird Party AdvisoryVDB Entry
- blog.fuzzing-project.org/2-Buffer-overflow-and-other-minor-issues-in-GnuPG-and-libksba-TFPA-0012014.htmlnvdThird Party Advisory
- www.mandriva.com/security/advisoriesnvdNot Applicable
- www.mandriva.com/security/advisoriesnvdNot Applicable
News mentions
0No linked articles in our index yet.