CVE-2014-3564 — gpgme: heap-based buffer overflow in gpgsm status handler

Back Back to CVE browser

MEDIUM

gpgme: heap-based buffer overflow in gpgsm status handler

Published Oct 20, 2014

6.8

MEDIUM

CVSS 2.0

EPSS 4.29%

Description

Multiple heap-based buffer overflows in the status_handler function in (1) engine-gpgsm.c and (2) engine-uiserver.c in GPGME before 1.5.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to "different line lengths in a specific order."

Affected products

Red Hat Enterprise Linux 6

gpgme

Will not fix
Red Hat Enterprise Linux 7

gpgme

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	gpgme	Will not fix	n/a
Red Hat Enterprise Linux 7	gpgme	Will not fix	n/a

Remediation

Red Hat statement

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Metrics

4.29% 0.04289

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.04289

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	4.29% (0.04289)	90.81th	v5 (v2026.06.15)
Jun 15, 2026	4.29% (0.04289)	89.81th	v5 (v2026.06.15)
Mar 30, 2025	2.86% (0.02864)	85.03th	v4 (v2025.03.14)
Mar 29, 2025	5.87% (0.05874)	83.87th	v4 (v2025.03.14)
Mar 17, 2025	2.86% (0.02864)	85.34th	v4 (v2025.03.14)
Dec 12, 2024	3.57% (0.03571)	91.97th	v3 (v2023.03.01)
Jun 27, 2023	3.57% (0.03571)	90.30th	v3 (v2023.03.01)
Mar 7, 2023	3.49% (0.03487)	90.05th	v3 (v2023.03.01)
Mar 6, 2023	4.97% (0.04967)	89.52th	v2 (v2022.01.01)
Apr 1, 2022	4.97% (0.04967)	88.46th	v2 (v2022.01.01)
Feb 4, 2022	4.97% (0.04967)	74.95th	v2 (v2022.01.01)

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-122

References (11)

http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git%3Ba=commit%3Bh=2cbd76f7911fc215845e89b50d6af5ff4a83dd77
x_refsource_CONFIRM
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=commit;h=2cbd76f7911fc215845e89b50d6af5ff4a83dd77
http://seclists.org/oss-sec/2014/q3/266
mailing-listx_refsource_MLIST
http://www.debian.org/security/2014/dsa-3005
vendor-advisoryx_refsource_DEBIAN
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
x_refsource_CONFIRM
http://www.osvdb.org/109699
vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/68990
vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2014-3564
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1113267
x_refsource_CONFIRMPatchIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2014-3564
https://www.cve.org/CVERecord?id=CVE-2014-3564

Link	Providers	Tags
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git%3Ba=commit%3Bh=2cbd76f7911fc215845e89b50d6af5ff4a83dd77		x_refsource_CONFIRM
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=commit;h=2cbd76f7911fc215845e89b50d6af5ff4a83dd77
http://seclists.org/oss-sec/2014/q3/266		mailing-listx_refsource_MLIST
http://www.debian.org/security/2014/dsa-3005		vendor-advisoryx_refsource_DEBIAN
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html		x_refsource_CONFIRM
http://www.osvdb.org/109699		vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/bid/68990		vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2014-3564		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1113267		x_refsource_CONFIRMPatchIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2014-3564
https://www.cve.org/CVERecord?id=CVE-2014-3564