Every CVE Search/ Get API key

CVE-2014-4617

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24...

5.0 MediumFix available

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Exploit likelihood

3.31%Up 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Record
CVE-2014-4617
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Record
CVE-2014-4617
Updated
2026-11-02
EUVDEUVD-2014-4543 No score

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Record
EUVD-2014-4543
Updated
2026-11-03
GitHub AdvisoriesGHSA-x662-2943-q7qh No score

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24...

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Record
GHSA-x662-2943-q7qh
Weakness
CWE-20
Updated
2026-11-02
OSVBELL-CVE-2014-4617 5.0

CVE-2014-4617 does not affect BellSoft software

Record
BELL-CVE-2014-4617
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSV No score

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Record
CVE-2014-4617
Updated
2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2014-4617 No score

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Record
DEBIAN-CVE-2014-4617
Updated
2026-11-02
OSVMGASA-2014-0276 No score

Updated gnupg & gnupg2 packages fixes CVE-2014-4617

Updated gnupg and gnupg2 packages fix security vulnerability:

GnuPG versions before 1.4.17 and 2.0.24 are vulnerable to a denial of service which can be caused by garbled compressed data packets which may put gpg into an infinite loop (CVE-2014-4617).

Record
MGASA-2014-0276
Updated
2026-11-02
OSVopenSUSE-SU-2024:10102-1 No score

gpg2-2.1.16-1.1 on GA media

These are all security issues fixed in the gpg2-2.1.16-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10102-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-4617 No score

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Record
UBUNTU-CVE-2014-4617
Updated
2026-11-02
OSVUSN-2258-1 No score

gnupg, gnupg2 vulnerability

Jean-René Reinhard, Olivier Levillain and Florian Maury discovered that GnuPG incorrectly handled certain OpenPGP messages. If a user or automated system were tricked into processing a specially-crafted message, GnuPG could consume resources, resulting in a denial of service.

Record
USN-2258-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gnupg2
Debian:12
 before 2.0.24-1
2.0.24-1
gnupg2
Debian:13
 before 2.0.24-1
2.0.24-1
gnupg2
Debian:14
 before 2.0.24-1
2.0.24-1
gnupg
Debian:6.0
 before 1.4.10-4+squeeze5, plus listed versions
1.4.10-41.4.10-4+squeeze11.4.10-4+squeeze21.4.10-4+squeeze31.4.10-4+squeeze4
1.4.10-4+squeeze5
gnupg2
Debian:6.0
 before 2.0.14-2+squeeze2, plus listed versions
2.0.14-22.0.14-2+squeeze1
2.0.14-2+squeeze2
gnupg
Debian:7
 before 1.4.12-7+deb7u4, plus listed versions
1.4.12-71.4.12-7+deb7u11.4.12-7+deb7u21.4.12-7+deb7u3
1.4.12-7+deb7u4
gnupg2
Debian:7
 before 2.0.19-2+deb7u2, plus listed versions
2.0.19-22.0.19-2+deb7u1
2.0.19-2+deb7u2
gnupg
Mageia:3
 before 1.4.14-1.3.mga3
1.4.14-1.3.mga3
gnupg2
Mageia:3
 before 2.0.19-3.3.mga3
2.0.19-3.3.mga3
gnupg
Mageia:4
 before 1.4.16-1.1.mga4
1.4.16-1.1.mga4
Show 4 moreShow less
Affected packages
PackageAffectedFixed
gnupg2
Mageia:4
 before 2.0.22-3.1.mga4
2.0.22-3.1.mga4
gnupg
Ubuntu:14.04:LTS
 before 1.4.16-1ubuntu2.1, plus listed versions
1.4.14-1ubuntu21.4.15-1.1ubuntu11.4.15-1.1ubuntu21.4.15-2ubuntu11.4.16-1ubuntu11.4.16-1ubuntu2
1.4.16-1ubuntu2.1
gnupg2
Ubuntu:14.04:LTS
 before 2.0.22-3ubuntu1.1, plus listed versions
2.0.20-1ubuntu32.0.22-1ubuntu12.0.22-3ubuntu1
2.0.22-3ubuntu1.1
gpg2
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 2.1.16-1.1
2.1.16-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-4617 is a medium vulnerability (CVSS 5.0) in Gnupg, published June 25, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.31%, the 88th percentile. Fixed in gnupg2 2.0.24-1.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open