vulnwire
5.3med

CVE-2016-6313

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.6%
percentile 90%
Public exploits
0
none known

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.

Exploit prediction (EPSS)

3.60% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • debian.org /security/2016/dsa-3650 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • security.gentoo.org /glsa/201612-01 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • ubuntu.com /usn/USN-3064-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • debian.org /security/2016/dsa-3649 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • security.gentoo.org /glsa/201610-04 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securitytracker.com /id/1036635 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • lists.gnupg.org /pipermail/gnupg-announce/2016q3/000395.html · mailing-list, x_refsource_MLIST, x_transferred
  • git.gnupg.org /cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=blob_plain%3Bf=NEWS · x_refsource_CONFIRM, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2674.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/92527 · vdb-entry, x_refsource_BID, x_transferred
  • ubuntu.com /usn/USN-3065-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.