Mageia alert MGASA-2013-0003 (gnupg)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2013-0003: gnupg-1.4.12-1.1.mga2,
 gnupg2-2.0.18-1.2.mga2 (2/core) 
Date:
    	     
 
Sat, 5 Jan 2013 19:37:32 +0100
Message-ID:
    	     
 
<20130105183732.GA18109@valstar.mageia.org>
Archive-link:
    	     
 
Article, Thread
              
MGASA-2013-0003
Date: 	January 5th, 2013
Affected releases: 	2


Description:
Updated gnupg and gnupg2 packages fix security vulnerability:

Versions of GnuPG <= 1.4.12 and GnuPG2 <= 2.0.19 are vulnerable to memory
access violations and public keyring database corruption when importing
public keys that have been manipulated. An OpenPGP key can be fuzzed in
such a way that gpg segfaults (or has other memory access violations)
when importing the key (CVE-2012-6085).


Updated Packages:
gnupg-1.4.12-1.1.mga2
gnupg2-2.0.18-1.2.mga2


References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6085
https://bugs.g10code.com/gnupg/issue1455
https://bugzilla.redhat.com/show_bug.cgi?id=891142
http://www.mandriva.com/en/support/security/advisories/?d...
https://bugs.mageia.org/show_bug.cgi?id=8572
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-...