MGASA-2016-0072

    Dashboard / Vulnerabilities / MGASA-2016-0072

    MGASA-2016-0072

    Published: 17 Feb 2016Last Modified: 16 Apr 2026
    Upstream:
    CVE-2015-7511

    Summary: Updated libgcrypt packages fix security vulnerabilities

    Details: Updated libgcrypt packages fix security vulnerability: Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack (CVE-2015-7511). The libgcrypt package was also updated to include countermeasures against Lenstra's fault attack on RSA Chinese Remainder Theorem optimization in RSA. A signature verification step was updated to protect against leaks of private keys in case of hardware faults or implementation errors in numeric libraries. This issue is equivalent to the CVE-2015-5738 issue in gnupg.

    References: https://advisories.mageia.org/MGASA-2016-0072.html, https://bugs.mageia.org/show_bug.cgi?id=17742, http://lists.opensuse.org/opensuse-updates/2015-09/msg00033.html, https://www.debian.org/security/2016/dsa-3474, https://bugs.mageia.org/show_bug.cgi?id=16806, https://bugs.mageia.org/show_bug.cgi?id=17742

    Affected packages

    Package

    Name: libgcrypt

    Purl: pkg:rpm/mageia/libgcrypt?arch=source&distro=mageia-5

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.5.4-5.2.mga5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High