CVE catalog

CVE-2015-1606

gnupg2: CVE-2015-1606

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.92% · Oct 25, 2026

The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangnupg2sid2.4.9-8fixed
Debiangnupg2forky2.4.9-8fixed
Debiangnupg2trixie2.4.7-21+deb13u1fixed
Debiangnupg2bookworm2.2.40-1.1+deb12u2fixed
Susegpg2linux enterprise desktop 122.0.24-3.2fixed
Susegpg2linux enterprise server 122.0.24-3.2fixed
Susegpg2linux enterprise server for sap applications 122.0.24-3.2fixed
Ubuntugnupg14.041.4.14-1ubuntu2vulnerable
Ubuntugnupg14.041.4.15-1.1ubuntu1vulnerable
Ubuntugnupg14.041.4.15-1.1ubuntu2vulnerable
Ubuntugnupg14.041.4.15-2ubuntu1vulnerable
Ubuntugnupg14.041.4.16-1ubuntu1vulnerable
Ubuntugnupg14.041.4.16-1ubuntu2vulnerable
Ubuntugnupg14.041.4.16-1ubuntu2.1vulnerable
Ubuntugnupg14.041.4.16-1ubuntu2.3fixed
Ubuntugnupg214.042.0.20-1ubuntu3vulnerable
Ubuntugnupg214.042.0.22-1ubuntu1vulnerable
Ubuntugnupg214.042.0.22-3ubuntu1vulnerable
Ubuntugnupg214.042.0.22-3ubuntu1.1vulnerable
Ubuntugnupg214.042.0.22-3ubuntu1.3fixed
Susegpg2linux enterprise desktop 11 sp32.0.9-25.33.41.2fixed
Susegpg2linux enterprise desktop 11 sp42.0.9-25.33.41.2fixed
Susegpg2linux enterprise server 11 sp32.0.9-25.33.41.2fixed
Susegpg2linux enterprise server 11 sp3-teradata2.0.9-25.33.41.2fixed
Susegpg2linux enterprise server for sap applications 11 sp32.0.9-25.33.41.2fixed
Susegpg2linux enterprise server 11 sp42.0.9-25.33.41.2fixed
Susegpg2linux enterprise server for sap applications 11 sp42.0.9-25.33.41.2fixed
Susegpg2linux enterprise desktop 12 sp12.0.24-3.2fixed
Susegpg2linux enterprise server 12 sp12.0.24-3.2fixed
Susegpg2linux enterprise server for sap applications 12 sp12.0.24-3.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangnupg2sourcesid2.0.26-5not yet assignedNot reported[778577]
Debiangnupg2sourceforky2.0.26-5not yet assignedNot reported[778577]
Debiangnupg2sourcetrixie2.0.26-5not yet assignedNot reported[778577]
Debiangnupg2sourcebookworm2.0.26-5not yet assignedNot reported[778577]
Susegpg2rpmlinux enterprise desktop 122.0.24-3.2Not reportedSUSE-SU-2015:2171-1Not reported
Susegpg2rpmlinux enterprise server 122.0.24-3.2Not reportedSUSE-SU-2015:2171-1Not reported
Susegpg2rpmlinux enterprise server for sap applications 122.0.24-3.2Not reportedSUSE-SU-2015:2171-1Not reported
Ubuntugnupgdeb14.041.4.16-1ubuntu2.3Not reportedUBUNTU-CVE-2015-1606Not reported
Ubuntugnupg2deb14.042.0.22-3ubuntu1.3Not reportedUBUNTU-CVE-2015-1606Not reported
Susegpg2rpmlinux enterprise desktop 11 sp32.0.9-25.33.41.2Not reportedSUSE-SU-2015:2170-1Not reported
Susegpg2rpmlinux enterprise desktop 11 sp42.0.9-25.33.41.2Not reportedSUSE-SU-2015:2170-1Not reported
Susegpg2rpmlinux enterprise server 11 sp32.0.9-25.33.41.2Not reportedSUSE-SU-2015:2170-1Not reported
Susegpg2rpmlinux enterprise server 11 sp3-teradata2.0.9-25.33.41.2Not reportedSUSE-SU-2015:2170-1Not reported
Susegpg2rpmlinux enterprise server for sap applications 11 sp32.0.9-25.33.41.2Not reportedSUSE-SU-2015:2170-1Not reported
Susegpg2rpmlinux enterprise server 11 sp42.0.9-25.33.41.2Not reportedSUSE-SU-2015:2170-1Not reported
Susegpg2rpmlinux enterprise server for sap applications 11 sp42.0.9-25.33.41.2Not reportedSUSE-SU-2015:2170-1Not reported
Susegpg2rpmlinux enterprise desktop 12 sp12.0.24-3.2Not reportedSUSE-SU-2015:2171-2Not reported
Susegpg2rpmlinux enterprise server 12 sp12.0.24-3.2Not reportedSUSE-SU-2015:2171-2Not reported
Susegpg2rpmlinux enterprise server for sap applications 12 sp12.0.24-3.2Not reportedSUSE-SU-2015:2171-2Not reported

[Debian bug #778577]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [dirmngr]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gnupg]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gnupg2]Fixed
    Details (2)

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gnupg-agent]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gnupg-l10n]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gnupg-utils]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gpg]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gpg-agent]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gpgconf]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gpgsm]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gpgv]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gpgv2]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gpgv-static]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gpgv-win32]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gpg-wks-client]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [gpg-wks-server]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

  • [scdaemon]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.2.40-1.1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

    • 2.2.40-1.1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · bookworm; dsa · gnupg2 · debian · 12

[Debian 13 (Trixie)]

  • [dirmngr]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.4.7-21+deb13u1+b4 · amd64 · trixie

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · 13

    • 2.4.7-21+deb13u1+b4 · arm64 · trixie

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · 13

  • [gnupg]Fixed

    Source package: [gnupg2]

    Details (2)

    • 2.4.7-21+deb13u1 · all · trixie

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · 13

    • 2.4.7-21+deb13u1 · all · trixie

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · 13

  • [gnupg2]Fixed
    Details (2)

    • 2.4.7-21+deb13u1 · all · trixie

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · 13

    • 2.4.7-21+deb13u1 · all · trixie

      Fixed · Fixed: 2.0.26-5

      dsa · gnupg2 · debian · 13

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]