CVE-2016-6313

MEDIUM

Libgcrypt <1.5.6, 1.6.x <1.6.6, 1.7.x <1.7.3 - Info Disclosure

Title source: llm
STIX 2.1

Description

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.

References (11)

Core 11
Core References
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3650
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201612-01
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3064-1
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3649
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201610-04
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036635
Mailing List, Vendor Advisory mailing-list x_refsource_mlist
https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2674.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/92527
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3065-1

Scores

CVSS v3 5.3
EPSS 0.0360
EPSS Percentile 88.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (15)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
debian/debian_linux 8.0
gnupg/gnupg < 1.4.14
gnupg/libgcrypt 1.6.0
gnupg/libgcrypt 1.6.1
gnupg/libgcrypt 1.6.2
gnupg/libgcrypt 1.6.3
gnupg/libgcrypt 1.6.4
... and 5 more
Published Dec 13, 2016
Tracked Since Feb 18, 2026