CVE-2022-3515
Critical
Description
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.
SeverityCritical
CVSS9.8
Exploit probability—
ProductGnupg Libksba
PublishedJan 12, 2023
First seenJan 12, 2023
Weakness typeCWE-190Integer overflow
How to fix
Update
- gnupg libksba1.6.3 or later
- gpg4win gpg4win4.1.0 or later
- gnupg vs-desktop3.1.26 or later
- gnupg gnupg2.2.41, 2.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnupg libksba | v < 1.6.3 | 1.6.3 |
| gpg4win gpg4win | 2.0.0 ≤ v < 4.1.0 | 4.1.0 |
| gnupg vs-desktop | 3.1.16 ≤ v < 3.1.26 | 3.1.26 |
| gnupg gnupg | 2.1.0 ≤ v < 2.2.41, 2.3.0 ≤ v < 2.4.0 | 2.2.41, 2.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.