GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2006-6169 (GCVE-0-2006-6169)

Vulnerability from cvelistv5 – Published: 2006-11-29 18:00 – Updated: 2024-08-07 20:19
VLAI
Summary
Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt.
Severity
No CVSS data available.
CWE
  • n/a
Assigner
References
URL Tags
http://secunia.com/advisories/23110 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23269 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23303 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/archive/1/452829/100… mailing-listx_refsource_BUGTRAQ
https://issues.rpath.com/browse/RPL-826 x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://secunia.com/advisories/23513 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23284 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23146 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23171 third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/usn-393-2 vendor-advisoryx_refsource_UBUNTU
http://www.redhat.com/support/errata/RHSA-2006-07… vendor-advisoryx_refsource_REDHAT
http://www.trustix.org/errata/2006/0068/ vendor-advisoryx_refsource_TRUSTIX
http://securityreason.com/securityalert/1927 third-party-advisoryx_refsource_SREASON
http://www.debian.org/security/2006/dsa-1231 vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/23299 third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/usn-389-1 vendor-advisoryx_refsource_UBUNTU
https://bugs.g10code.com/gnupg/issue728 x_refsource_MISC
http://securitytracker.com/id?1017291 vdb-entryx_refsource_SECTRACK
http://security.gentoo.org/glsa/glsa-200612-03.xml vendor-advisoryx_refsource_GENTOO
http://lists.gnupg.org/pipermail/gnupg-announce/2… mailing-listx_refsource_MLIST
http://secunia.com/advisories/23094 third-party-advisoryx_refsource_SECUNIA
http://lists.suse.com/archive/suse-security-annou… vendor-advisoryx_refsource_SUSE
http://support.avaya.com/elmodocs2/security/ASA-2… x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/453253/100… mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/21306 vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2006/4736 vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/23250 third-party-advisoryx_refsource_SECUNIA
ftp://patches.sgi.com/support/free/security/advis… vendor-advisoryx_refsource_SGI
http://secunia.com/advisories/23161 third-party-advisoryx_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRIVA
http://www.openpkg.com/security/advisories/OpenPK… vendor-advisoryx_refsource_OPENPKG
https://oval.cisecurity.org/repository/search/def… vdb-entrysignaturex_refsource_OVAL
http://secunia.com/advisories/24047 third-party-advisoryx_refsource_SECUNIA
Date Public
2006-11-27 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T20:19:34.866Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "23110",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23110"
          },
          {
            "name": "23269",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23269"
          },
          {
            "name": "23303",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23303"
          },
          {
            "name": "20061127 GnuPG 1.4 and 2.0 buffer overflow",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/452829/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.rpath.com/browse/RPL-826"
          },
          {
            "name": "gnupg-openfile-bo(30550)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30550"
          },
          {
            "name": "23513",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23513"
          },
          {
            "name": "23284",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23284"
          },
          {
            "name": "23146",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23146"
          },
          {
            "name": "23171",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23171"
          },
          {
            "name": "USN-393-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-393-2"
          },
          {
            "name": "RHSA-2006:0754",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0754.html"
          },
          {
            "name": "2006-0068",
            "tags": [
              "vendor-advisory",
              "x_refsource_TRUSTIX",
              "x_transferred"
            ],
            "url": "http://www.trustix.org/errata/2006/0068/"
          },
          {
            "name": "1927",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/1927"
          },
          {
            "name": "DSA-1231",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2006/dsa-1231"
          },
          {
            "name": "23299",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23299"
          },
          {
            "name": "USN-389-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-389-1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.g10code.com/gnupg/issue728"
          },
          {
            "name": "1017291",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1017291"
          },
          {
            "name": "GLSA-200612-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200612-03.xml"
          },
          {
            "name": "[gnupg-announce] 20061127 GnuPG 1.4 and 2.0 buffer overflow",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html"
          },
          {
            "name": "23094",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23094"
          },
          {
            "name": "SUSE-SA:2006:075",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm"
          },
          {
            "name": "20061201 rPSA-2006-0224-1 gnupg",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/453253/100/100/threaded"
          },
          {
            "name": "21306",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/21306"
          },
          {
            "name": "ADV-2006-4736",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/4736"
          },
          {
            "name": "23250",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23250"
          },
          {
            "name": "20061201-01-P",
            "tags": [
              "vendor-advisory",
              "x_refsource_SGI",
              "x_transferred"
            ],
            "url": "ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc"
          },
          {
            "name": "23161",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23161"
          },
          {
            "name": "MDKSA-2006:221",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:221"
          },
          {
            "name": "OpenPKG-SA-2006.037",
            "tags": [
              "vendor-advisory",
              "x_refsource_OPENPKG",
              "x_transferred"
            ],
            "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html"
          },
          {
            "name": "oval:org.mitre.oval:def:11228",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11228"
          },
          {
            "name": "24047",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/24047"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-11-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with \"C-escape\" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "23110",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23110"
        },
        {
          "name": "23269",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23269"
        },
        {
          "name": "23303",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23303"
        },
        {
          "name": "20061127 GnuPG 1.4 and 2.0 buffer overflow",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/452829/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.rpath.com/browse/RPL-826"
        },
        {
          "name": "gnupg-openfile-bo(30550)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30550"
        },
        {
          "name": "23513",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23513"
        },
        {
          "name": "23284",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23284"
        },
        {
          "name": "23146",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23146"
        },
        {
          "name": "23171",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23171"
        },
        {
          "name": "USN-393-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-393-2"
        },
        {
          "name": "RHSA-2006:0754",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2006-0754.html"
        },
        {
          "name": "2006-0068",
          "tags": [
            "vendor-advisory",
            "x_refsource_TRUSTIX"
          ],
          "url": "http://www.trustix.org/errata/2006/0068/"
        },
        {
          "name": "1927",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/1927"
        },
        {
          "name": "DSA-1231",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2006/dsa-1231"
        },
        {
          "name": "23299",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23299"
        },
        {
          "name": "USN-389-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-389-1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.g10code.com/gnupg/issue728"
        },
        {
          "name": "1017291",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1017291"
        },
        {
          "name": "GLSA-200612-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200612-03.xml"
        },
        {
          "name": "[gnupg-announce] 20061127 GnuPG 1.4 and 2.0 buffer overflow",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html"
        },
        {
          "name": "23094",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23094"
        },
        {
          "name": "SUSE-SA:2006:075",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm"
        },
        {
          "name": "20061201 rPSA-2006-0224-1 gnupg",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/453253/100/100/threaded"
        },
        {
          "name": "21306",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/21306"
        },
        {
          "name": "ADV-2006-4736",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/4736"
        },
        {
          "name": "23250",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23250"
        },
        {
          "name": "20061201-01-P",
          "tags": [
            "vendor-advisory",
            "x_refsource_SGI"
          ],
          "url": "ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc"
        },
        {
          "name": "23161",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23161"
        },
        {
          "name": "MDKSA-2006:221",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:221"
        },
        {
          "name": "OpenPKG-SA-2006.037",
          "tags": [
            "vendor-advisory",
            "x_refsource_OPENPKG"
          ],
          "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html"
        },
        {
          "name": "oval:org.mitre.oval:def:11228",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11228"
        },
        {
          "name": "24047",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/24047"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-6169",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with \"C-escape\" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "23110",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23110"
            },
            {
              "name": "23269",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23269"
            },
            {
              "name": "23303",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23303"
            },
            {
              "name": "20061127 GnuPG 1.4 and 2.0 buffer overflow",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/452829/100/0/threaded"
            },
            {
              "name": "https://issues.rpath.com/browse/RPL-826",
              "refsource": "CONFIRM",
              "url": "https://issues.rpath.com/browse/RPL-826"
            },
            {
              "name": "gnupg-openfile-bo(30550)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30550"
            },
            {
              "name": "23513",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23513"
            },
            {
              "name": "23284",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23284"
            },
            {
              "name": "23146",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23146"
            },
            {
              "name": "23171",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23171"
            },
            {
              "name": "USN-393-2",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/usn-393-2"
            },
            {
              "name": "RHSA-2006:0754",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2006-0754.html"
            },
            {
              "name": "2006-0068",
              "refsource": "TRUSTIX",
              "url": "http://www.trustix.org/errata/2006/0068/"
            },
            {
              "name": "1927",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/1927"
            },
            {
              "name": "DSA-1231",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2006/dsa-1231"
            },
            {
              "name": "23299",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23299"
            },
            {
              "name": "USN-389-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/usn-389-1"
            },
            {
              "name": "https://bugs.g10code.com/gnupg/issue728",
              "refsource": "MISC",
              "url": "https://bugs.g10code.com/gnupg/issue728"
            },
            {
              "name": "1017291",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1017291"
            },
            {
              "name": "GLSA-200612-03",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200612-03.xml"
            },
            {
              "name": "[gnupg-announce] 20061127 GnuPG 1.4 and 2.0 buffer overflow",
              "refsource": "MLIST",
              "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html"
            },
            {
              "name": "23094",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23094"
            },
            {
              "name": "SUSE-SA:2006:075",
              "refsource": "SUSE",
              "url": "http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm"
            },
            {
              "name": "20061201 rPSA-2006-0224-1 gnupg",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/453253/100/100/threaded"
            },
            {
              "name": "21306",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/21306"
            },
            {
              "name": "ADV-2006-4736",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/4736"
            },
            {
              "name": "23250",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23250"
            },
            {
              "name": "20061201-01-P",
              "refsource": "SGI",
              "url": "ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc"
            },
            {
              "name": "23161",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23161"
            },
            {
              "name": "MDKSA-2006:221",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:221"
            },
            {
              "name": "OpenPKG-SA-2006.037",
              "refsource": "OPENPKG",
              "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html"
            },
            {
              "name": "oval:org.mitre.oval:def:11228",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11228"
            },
            {
              "name": "24047",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/24047"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-6169",
    "datePublished": "2006-11-29T18:00:00.000Z",
    "dateReserved": "2006-11-29T00:00:00.000Z",
    "dateUpdated": "2024-08-07T20:19:34.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2006-6169",
      "date": "2026-09-20",
      "epss": "0.03257",
      "percentile": "0.87801"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:gnupg:gnupg:1.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "365FF476-1FFD-4E09-900C-50E0660766AB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:gnupg:gnupg:2.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "47C64072-FC9C-4CA9-9752-3BC08839E319",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with \"C-escape\" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt."
          },
          {
            "lang": "es",
            "value": "Desbordamiento de b\u00fafer basado en mont\u00edculo en la funci\u00f3n ask_outfile_name en el openfile.c para GnuPG (gpg) 1.4 y 2.0, cuando se est\u00e1 ejecutando interactivamente, podr\u00eda permitir a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n mediante mensajes con expansiones \"C-escape\", que provocan que la funci\u00f3n make_printable_string devuelva una cadena m\u00e1s larga de lo esperado mientras construye un aviso."
          }
        ],
        "id": "CVE-2006-6169",
        "lastModified": "2026-04-23T00:35:47.467",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.8,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": true,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2006-11-29T18:28:00.000",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/23094"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/23110"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/23146"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/23161"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/23171"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/23250"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/23269"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/23284"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/23299"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/23303"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/23513"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/24047"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://security.gentoo.org/glsa/glsa-200612-03.xml"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://securityreason.com/securityalert/1927"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://securitytracker.com/id?1017291"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.debian.org/security/2006/dsa-1231"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:221"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0754.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/452829/100/0/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/453253/100/100/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/bid/21306"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.trustix.org/errata/2006/0068/"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.ubuntu.com/usn/usn-389-1"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.ubuntu.com/usn/usn-393-2"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2006/4736"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://bugs.g10code.com/gnupg/issue728"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30550"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://issues.rpath.com/browse/RPL-826"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11228"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/23094"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/23110"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/23146"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/23161"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/23171"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/23250"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/23269"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/23284"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/23299"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/23303"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/23513"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/24047"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://security.gentoo.org/glsa/glsa-200612-03.xml"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://securityreason.com/securityalert/1927"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://securitytracker.com/id?1017291"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.debian.org/security/2006/dsa-1231"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:221"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0754.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/452829/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/453253/100/100/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/21306"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.trustix.org/errata/2006/0068/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.ubuntu.com/usn/usn-389-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.ubuntu.com/usn/usn-393-2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2006/4736"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://bugs.g10code.com/gnupg/issue728"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30550"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://issues.rpath.com/browse/RPL-826"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11228"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vendorComments": [
          {
            "comment": "Red Hat does not consider this bug to be a security flaw.  In order for this flaw to be exploited, a user would be required to enter shellcode into an interactive GnuPG session. Red Hat considers this to be an unlikely scenario.\n\nRed Hat Enterprise Linux 5 contains a backported patch to address this issue.",
            "lastModified": "2007-03-14T00:00:00",
            "organization": "Red Hat"
          }
        ],
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T13:21:10+00:00",
      "cve": "CVE-2006-6169",
      "id": "CVE-2006-6169",
      "initial_release_date": "2006-11-24T00:00:00+00:00",
      "product_status:fixed": "116",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": ": gnupg2 \u003c 2.0.1 buffer overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2006/cve-2006-6169.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.