CVE-2014-4617: Debian Linux

Medium severity, CVSS 5.0. EPSS: 3.3% chance of exploitation in the next 30 days.

The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.

Affected products

• Debian Debian Linux: version 7.0 only
• Gnupg Gnupg: version 2.0 only; version 2.0.1 only; version 2.0.3 only; version 2.0.4 only; version 2.0.5 only; version 2.0.6 only; …
• Opensuse Opensuse: version 12.3 only; version 13.1 only

Published 2014-06-25. Last modified 2026-06-17.