Libgcrypt CVE-2015-0837 Local Information Disclosure Vulnerability

Bugtraq ID:	73064
Class:	Design Error
CVE:	CVE-2015-0837
Remote:	No
Local:	Yes
Published:	Mar 03 2015 12:00AM
Updated:	Oct 26 2016 11:07AM
Credit:	The vendor reported this issue.
Vulnerable:	Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Slackware Slackware Linux 14.1 Slackware Slackware Linux 14.0 Slackware Slackware Linux 13.37 Slackware Slackware Linux 13.1 Slackware Slackware Linux 13.0 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Gnupg Libgcrypt 1.6.1 Gnupg Libgcrypt 1.6 Gnupg Libgcrypt 1.5.4 Gnupg Libgcrypt 1.6.2 Gnupg Libgcrypt 1.5.3 Gnupg Libgcrypt 1.5.2 Gnupg Libgcrypt 1.5.1 Gnupg Libgcrypt 1.5.0 Gnupg Libgcrypt 1.4.6 Gnupg Libgcrypt 1.4.5 Gnupg Libgcrypt 1.4.4 Gnupg Libgcrypt 1.4.3 Gnupg Libgcrypt 1.4.0 Gnupg Gnupg 1.4.17 Gnupg Gnupg 1.4.15 Gnupg Gnupg 1.4.14 Gnupg Gnupg 1.4.13 Gnupg Gnupg 1.4.12 Gnupg Gnupg 1.4.11 Gnupg Gnupg 1.4.10 Gnupg Gnupg 1.4.8 Gnupg Gnupg 1.4.5 Gnupg Gnupg 1.4.2 Gnupg Gnupg 1.4.4 Gnupg Gnupg 1.4.18 Gnupg Gnupg 1.4.16 Gnupg Gnupg 1.4.0 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Gnupg Libgcrypt 1.6.3 Gnupg Gnupg 1.4.19

Libgcrypt CVE-2015-0837 Local Information Disclosure Vulnerability

Libgcrypt is prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to disclose sensitive information. Information obtained may lead to further attacks.

Versions prior to Libgcrypt 1.6.3 are vulnerable.

Libgcrypt CVE-2015-0837 Local Information Disclosure Vulnerability

Local attackers can use standard tools to exploit this issue.

Libgcrypt CVE-2015-0837 Local Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva gnupg-1.4.12-3.6.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64gcrypt-devel-1.5.4-1.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64gcrypt11-1.5.4-1.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Libgcrypt CVE-2015-0837 Local Information Disclosure Vulnerability

References:

• [Announce] GnuPG 1.4.19 released (with SCA fix) (Gnupg)
  
• [Announce] Libgcrypt 1.6.3 released (with SCA fix) (Gnupg)
  
• Libgcrypt HomePage (Libgcrypt)
  
• [slackware-security] gnupg (SSA:2015-111-02) (Slackware)