CVE request: GnuPG Import Key Memory Corruption

[Robert Buchholz <rbu () gentoo org>]

Hi,

there's a memory corruption triggered when importing malformed keys 
using GnuPG 1.4.8 and 2.0.8. Prior and later versions are not affected. 
Exploitability to execute code is unknown.

References:
http://www.ocert.org/advisories/ocert-2008-1.html
https://bugs.g10code.com/gnupg/issue894
https://bugs.gentoo.org/show_bug.cgi?id=214990


Thanks,
Robert

Attachment: signature.asc
Description: This is a digitally signed message part.