CVE-2013-4242

Canonical Ubuntu Linux < 1.4.13 - Information Disclosure

Title source: rule
STIX 2.1

Description

GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload.

References (16)

Core 16
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1457.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/54332
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2731
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/54321
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/54375
Vendor Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-08/msg00003.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/61464
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1923-1
Various Sources x_refsource_misc
http://eprint.iacr.org/2013/448
Various Sources mailing-list x_refsource_mlist
http://lists.gnupg.org/pipermail/gnupg-announce/2013q3/000330.html
US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/976534
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2730
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/54318

Scores

EPSS 0.0053
EPSS Percentile 41.1%

Details

CWE
CWE-200
Status published
Products (47)
canonical/ubuntu_linux 10.04
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 12.10
canonical/ubuntu_linux 13.04
debian/debian_linux 6.0
debian/debian_linux 7.0
gnupg/gnupg 0.0.0
gnupg/gnupg 0.2.15
gnupg/gnupg 0.2.16
gnupg/gnupg 0.2.17
... and 37 more
Published Aug 19, 2013
Tracked Since Feb 18, 2026