Advisory published here:
A complex tool like GnuPG has many ways to parse input data. I
previously had fuzzed GnuPG which had led to the detection of a Buffer
Overflow vulnerability in GnuPG and libksba (CVE-2014-9087). Recently I
tried to fuzz less obvious inputs of GnuPG: Keyrings and configuration
GnuPG allows to specify a non-standard keyring on the command line.
Fuzzing GPG with gpg --export --no-default-keyring --keyring [input
keyring] led to the detection of various issues. (Please note that the
keyring parameter needs the full path and does not like filenames with
unusual characters like the ones generated by american fuzzy lop.)
NULL pointer deref in parse_trust (parse-packet.c)
NULL pointer deref in do_key (build-packet.c)
Use after free (build-packet.c)
memcpy with overlapping ranges (keybox_search.c)
All issues found with american fuzzy lop. Fuzzing of the configuration
file parser showed no issues.
While keyrings are usually not user-submitted data, some of these can
be reached through other code paths. None of the issues looks severe,
however judging the exact security would require further analysis.
2015-02-06 Reported three issues to GnuPG developer Werner Koch
2015-02-09 ALl reported issues fixed in git
2015-02-09 Reported one more issue to Werner Koch
2015-02-11 Last issue fixed in git
2015-02-11 Release of GnuPG 2.1.2 containing all fixes
mail/jabber: hanno () hboeck de
GnuPG 2.1.2 is already in tree, but I take it at least some of these issues also affects 2.0 as indicated by WK's: "I plan to do that but first 2.1 needs to get more stable. And I have to do maintenance release of 1.4 and 2.0 too. I am currently working on 2.0." ( https://lists.gnupg.org/pipermail/gnupg-devel/2015-February/029492.html )
All issues were fixed in v2.1.2 which appeared in Gentoo via https://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/app-crypt/gnupg/gnupg-2.1.2.ebuild?hideattic=0&view=log
This issue is likely fixed in 2.0.27 (https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000362.html) and 1.4.19 (https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html), but 2.0 series is anyways on its way out in bug 606604 - 1.4 however will remain in tree for the foreseeable future
GLSA Vote: No
Arches and Maintainer(s), Thank you for your work.