debian.org
http://www.debian.org/security/2015/dsa-3184 CVE-2015-0837
MEDIUM
Record summary
CVE-2015-0837 has a selected CVSS score of 5.9 (medium).
Description
The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."
Description source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
GnuPGBrowse GNU / GnuPG | CVE List | before 1.4.19 | affected |
LibgcryptBrowse GNU / Libgcrypt | CVE List | before 1.6.3 | affected |
References
6debian.org
http://www.debian.org/security/2015/dsa-3185 ieeexplore.ieee.org
https://ieeexplore.ieee.org/document/7163050 lists.gnupg.orgConfirmation
https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html lists.gnupg.orgConfirmation
https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2015-0837