{"id":"CVE-2010-2547","aliases":["DEBIAN-CVE-2010-2547","DSA-2076-1","EUVD-2010-2551","GHSA-jjg3-cx5h-88wm","RHSA-2010:0603","openSUSE-SU-2024:10102-1"],"status":"published","title":"Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows...","description":"Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.05342,"percentile":0.92675,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2010-07-28T00:00:00Z","modified":"2026-10-23T18:03:42Z","fixes":[{"ecosystem":"Debian:12","package":"gnupg2","fixed_in":["2.0.14-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnupg2","fixed_in":["2.0.14-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnupg2","fixed_in":["2.0.14-2"],"sources":["osv"]},{"ecosystem":"Debian:5.0","package":"gnupg2","fixed_in":["2.0.9-3.1+lenny1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg2","fixed_in":["0:2.0.10-3.el5_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg2-debuginfo","fixed_in":["0:2.0.10-3.el5_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg2","fixed_in":["0:2.0.10-3.el5_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg2-debuginfo","fixed_in":["0:2.0.10-3.el5_5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-2"}]}]},{"source":"osv","ecosystem":"Debian:5.0","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-3.1+lenny1"}]}],"versions":["2.0.9-3.1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-3.el5_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-3.el5_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-3.el5_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-3.el5_5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.16-1.1"}]}],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnupg","product":"gnupg"}],"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:143","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Broken Link","advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/1988","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://issues.rpath.com/browse/RPL-3229","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"http://www.vupen.com/english/advisories/2010/1931","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/41945","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-August/044935.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.debian.org/security/2010/dsa-2076","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.securitytracker.com/id?1024247","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://secunia.com/advisories/38877","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/40841","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory","advisory"]},{"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0076","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"http://secunia.com/advisories/40718","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory","advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/3125","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link","advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/1950","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link","Vendor Advisory","advisory"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2010\u0026m=slackware-security.462008","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred","Broken Link","web"]},{"url":"http://www.vupen.com/english/advisories/2010/2217","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2547","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0603","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-2547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=618156","tags":["report"]},{"url":"https://github.com/advisories/GHSA-jjg3-cx5h-88wm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2010-2547","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0603.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2547","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4617","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2010-2547","description":"Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.","status":"published","published":"2010-08-05T18:00:00Z","modified":"2024-08-07T02:39:37.671Z","updated_at":"2026-11-02T14:33:27.01833Z"}],"euvd":[{"id":"EUVD-2010-2551","description":"Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.","status":"published","published":"2010-08-05T18:00:00Z","modified":"2024-08-07T02:39:37Z","updated_at":"2026-11-03T01:39:37.441741Z"}],"ghsa":[{"id":"GHSA-jjg3-cx5h-88wm","title":"Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows...","description":"Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.","status":"published","published":"2022-05-17T05:45:28Z","modified":"2024-02-11T05:08:17Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:55:35.698137Z"}],"nvd":[{"id":"CVE-2010-2547","description":"Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.","status":"published","published":"2010-08-05T18:17:57.243Z","modified":"2026-06-16T23:20:57.693Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:01:49.736647Z"}],"osv":[{"id":"CVE-2010-2547","description":"Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.","status":"published","published":"2010-08-05T18:17:57Z","modified":"2026-04-10T03:41:19.50054Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:43:57.991581Z"},{"id":"DEBIAN-CVE-2010-2547","description":"Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.","status":"published","published":"2010-08-05T18:17:57.243Z","modified":"2026-10-23T18:03:42.135129514Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:24.316685Z"},{"id":"DSA-2076-1","title":"gnupg2 - execution of arbitrary code","status":"published","published":"2010-07-28T00:00:00Z","modified":"2026-03-09T01:19:33.869784Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"openSUSE-SU-2024:10102-1","title":"gpg2-2.1.16-1.1 on GA media","description":"These are all security issues fixed in the gpg2-2.1.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:31:53.99317Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2010:0603","title":"Red Hat Security Advisory: gnupg2 security update","status":"published","published":"2024-09-15T18:33:59Z","modified":"2026-06-26T10:13:57Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}