CVE-2010-2547: debian debian_linux Use After Free
Vulnerability summary
CVE-2010-2547 is a high (CVSS 8.1) Use After Free vulnerability in debian debian_linux. EPSS estimates a 5.34% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 05-08-2010PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.34%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.34% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- gnupg2< 2.0.14-2 | < 2.0.9-3.1+lenny1
- debian_linuxEOL5.0
Redhat2 products
- gnupg2< 0:2.0.10-3.el5_5.1
- gnupg2-debuginfo< 0:2.0.10-3.el5_5.1
Fedoraproject1 product
- fedoraEOL13
Gnupg1 product
- gnupg≥ 2.0.0, ≤ 2.0.16
4 vendors · 6 products
References
26 links- www.mandriva.com/security/advisories?name=MDVSA-2010:143Vendor AdvisoryX Refsource MANDRIVABroken Link
- lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2010-August/044935.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
www.debian.org/security/2010/dsa-2076Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory- lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.htmlMailing ListX Refsource MLISTPatchVendor Advisory
Show all 26 references
- slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.462008Vendor AdvisoryX Refsource SLACKWAREBroken Link
