Vulnerability-Lookup

OPENSUSE-SU-2024:10815-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 20:06

Summary

dirmngr-2.2.27-2.4 on GA media

Severity

Moderate

Notes

Title of the patch: dirmngr-2.2.27-2.4 on GA media

Description of the patch: These are all security issues fixed in the dirmngr-2.2.27-2.4 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2024-10815

CVE-2006-0455

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2006-3746

Affected products

Recommended 12 products, the same list as for CVE-2006-0455

Threats

Impact moderate

CVE-2006-6169

Affected products

Recommended 12 products, the same list as for CVE-2006-0455

Threats

Impact moderate

CVE-2008-1530

Affected products

Recommended 12 products, the same list as for CVE-2006-0455

Threats

Impact moderate

CVE-2018-12020

7.3 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 12 products, the same list as for CVE-2006-0455

Threats

Impact important

CVE-2018-9234

2.2 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Affected products

Recommended 12 products, the same list as for CVE-2006-0455

Threats

Impact low

CVE-2019-14855

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 12 products, the same list as for CVE-2006-0455

Threats

Impact moderate

CVE-2020-25125

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 12 products, the same list as for CVE-2006-0455

Threats

Impact important

References

32 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2006-0455/	self
https://www.suse.com/security/cve/CVE-2006-3746/	self
https://www.suse.com/security/cve/CVE-2006-6169/	self
https://www.suse.com/security/cve/CVE-2008-1530/	self
https://www.suse.com/security/cve/CVE-2018-12020/	self
https://www.suse.com/security/cve/CVE-2018-9234/	self
https://www.suse.com/security/cve/CVE-2019-14855/	self
https://www.suse.com/security/cve/CVE-2020-25125/	self
https://www.suse.com/security/cve/CVE-2006-0455	external
https://bugzilla.suse.com/150742	external
https://www.suse.com/security/cve/CVE-2006-3746	external
https://bugzilla.suse.com/195569	external
https://www.suse.com/security/cve/CVE-2006-6169	external
https://bugzilla.suse.com/224108	external
https://www.suse.com/security/cve/CVE-2008-1530	external
https://bugzilla.suse.com/374254	external
https://www.suse.com/security/cve/CVE-2018-12020	external
https://bugzilla.suse.com/1096745	external
https://bugzilla.suse.com/1101134	external
https://www.suse.com/security/cve/CVE-2018-9234	external
https://bugzilla.suse.com/1088255	external
https://bugzilla.suse.com/1090647	external
https://bugzilla.suse.com/1217431	external
https://bugzilla.suse.com/1217437	external
https://www.suse.com/security/cve/CVE-2019-14855	external
https://bugzilla.suse.com/1157900	external
https://bugzilla.suse.com/1160243	external
https://bugzilla.suse.com/1181233	external
https://www.suse.com/security/cve/CVE-2020-25125	external
https://bugzilla.suse.com/1176034	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "dirmngr-2.2.27-2.4 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the dirmngr-2.2.27-2.4 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-10815",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10815-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2006-0455 page",
        "url": "https://www.suse.com/security/cve/CVE-2006-0455/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2006-3746 page",
        "url": "https://www.suse.com/security/cve/CVE-2006-3746/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2006-6169 page",
        "url": "https://www.suse.com/security/cve/CVE-2006-6169/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2008-1530 page",
        "url": "https://www.suse.com/security/cve/CVE-2008-1530/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-12020 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-12020/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-9234 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-9234/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-14855 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-14855/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-25125 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-25125/"
      }
    ],
    "title": "dirmngr-2.2.27-2.4 on GA media",
    "tracking": {
      "current_release_date": "2026-09-20T20:06:04Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:10815-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T20:06:04Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dirmngr-0:2.2.27-2.4.aarch64",
                "product": {
                  "name": "dirmngr-0:2.2.27-2.4.aarch64",
                  "product_id": "dirmngr-0:2.2.27-2.4.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/dirmngr@2.2.27-2.4?arch=aarch64\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gpg2-0:2.2.27-2.4.aarch64",
                "product": {
                  "name": "gpg2-0:2.2.27-2.4.aarch64",
                  "product_id": "gpg2-0:2.2.27-2.4.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gpg2@2.2.27-2.4?arch=aarch64\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gpg2-lang-0:2.2.27-2.4.aarch64",
                "product": {
                  "name": "gpg2-lang-0:2.2.27-2.4.aarch64",
                  "product_id": "gpg2-lang-0:2.2.27-2.4.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gpg2-lang@2.2.27-2.4?arch=aarch64\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dirmngr-0:2.2.27-2.4.ppc64le",
                "product": {
                  "name": "dirmngr-0:2.2.27-2.4.ppc64le",
                  "product_id": "dirmngr-0:2.2.27-2.4.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/dirmngr@2.2.27-2.4?arch=ppc64le\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gpg2-0:2.2.27-2.4.ppc64le",
                "product": {
                  "name": "gpg2-0:2.2.27-2.4.ppc64le",
                  "product_id": "gpg2-0:2.2.27-2.4.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gpg2@2.2.27-2.4?arch=ppc64le\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gpg2-lang-0:2.2.27-2.4.ppc64le",
                "product": {
                  "name": "gpg2-lang-0:2.2.27-2.4.ppc64le",
                  "product_id": "gpg2-lang-0:2.2.27-2.4.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gpg2-lang@2.2.27-2.4?arch=ppc64le\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dirmngr-0:2.2.27-2.4.s390x",
                "product": {
                  "name": "dirmngr-0:2.2.27-2.4.s390x",
                  "product_id": "dirmngr-0:2.2.27-2.4.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/dirmngr@2.2.27-2.4?arch=s390x\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gpg2-0:2.2.27-2.4.s390x",
                "product": {
                  "name": "gpg2-0:2.2.27-2.4.s390x",
                  "product_id": "gpg2-0:2.2.27-2.4.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gpg2@2.2.27-2.4?arch=s390x\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gpg2-lang-0:2.2.27-2.4.s390x",
                "product": {
                  "name": "gpg2-lang-0:2.2.27-2.4.s390x",
                  "product_id": "gpg2-lang-0:2.2.27-2.4.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gpg2-lang@2.2.27-2.4?arch=s390x\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "dirmngr-0:2.2.27-2.4.x86_64",
                "product": {
                  "name": "dirmngr-0:2.2.27-2.4.x86_64",
                  "product_id": "dirmngr-0:2.2.27-2.4.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/dirmngr@2.2.27-2.4?arch=x86_64\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gpg2-0:2.2.27-2.4.x86_64",
                "product": {
                  "name": "gpg2-0:2.2.27-2.4.x86_64",
                  "product_id": "gpg2-0:2.2.27-2.4.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gpg2@2.2.27-2.4?arch=x86_64\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "gpg2-lang-0:2.2.27-2.4.x86_64",
                "product": {
                  "name": "gpg2-lang-0:2.2.27-2.4.x86_64",
                  "product_id": "gpg2-lang-0:2.2.27-2.4.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnupg:gnupg:2.2.27:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/gpg2-lang@2.2.27-2.4?arch=x86_64\u0026upstream=gpg2-0:2.2.27-2.4.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dirmngr-0:2.2.27-2.4.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64"
        },
        "product_reference": "dirmngr-0:2.2.27-2.4.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dirmngr-0:2.2.27-2.4.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le"
        },
        "product_reference": "dirmngr-0:2.2.27-2.4.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dirmngr-0:2.2.27-2.4.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x"
        },
        "product_reference": "dirmngr-0:2.2.27-2.4.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "dirmngr-0:2.2.27-2.4.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64"
        },
        "product_reference": "dirmngr-0:2.2.27-2.4.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gpg2-0:2.2.27-2.4.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64"
        },
        "product_reference": "gpg2-0:2.2.27-2.4.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gpg2-0:2.2.27-2.4.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le"
        },
        "product_reference": "gpg2-0:2.2.27-2.4.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gpg2-0:2.2.27-2.4.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x"
        },
        "product_reference": "gpg2-0:2.2.27-2.4.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gpg2-0:2.2.27-2.4.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64"
        },
        "product_reference": "gpg2-0:2.2.27-2.4.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gpg2-lang-0:2.2.27-2.4.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64"
        },
        "product_reference": "gpg2-lang-0:2.2.27-2.4.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gpg2-lang-0:2.2.27-2.4.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le"
        },
        "product_reference": "gpg2-lang-0:2.2.27-2.4.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gpg2-lang-0:2.2.27-2.4.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x"
        },
        "product_reference": "gpg2-lang-0:2.2.27-2.4.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gpg2-lang-0:2.2.27-2.4.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
        },
        "product_reference": "gpg2-lang-0:2.2.27-2.4.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2006-0455",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2006-0455"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded.  Note: this also occurs when running the equivalent command \"gpg --verify\".",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2006-0455",
          "url": "https://www.suse.com/security/cve/CVE-2006-0455"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 150742 for CVE-2006-0455",
          "url": "https://bugzilla.suse.com/150742"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2006-0455"
    },
    {
      "cve": "CVE-2006-3746",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2006-3746"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2006-3746",
          "url": "https://www.suse.com/security/cve/CVE-2006-3746"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 195569 for CVE-2006-3746",
          "url": "https://bugzilla.suse.com/195569"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2006-3746"
    },
    {
      "cve": "CVE-2006-6169",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2006-6169"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with \"C-escape\" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2006-6169",
          "url": "https://www.suse.com/security/cve/CVE-2006-6169"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 224108 for CVE-2006-6169",
          "url": "https://bugzilla.suse.com/224108"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2006-6169"
    },
    {
      "cve": "CVE-2008-1530",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2008-1530"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers \"memory corruption around deduplication of user IDs.\"",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2008-1530",
          "url": "https://www.suse.com/security/cve/CVE-2008-1530"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 374254 for CVE-2008-1530",
          "url": "https://bugzilla.suse.com/374254"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2008-1530"
    },
    {
      "cve": "CVE-2018-12020",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-12020"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-12020",
          "url": "https://www.suse.com/security/cve/CVE-2018-12020"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1096745 for CVE-2018-12020",
          "url": "https://bugzilla.suse.com/1096745"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1101134 for CVE-2018-12020",
          "url": "https://bugzilla.suse.com/1101134"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2018-12020"
    },
    {
      "cve": "CVE-2018-9234",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-9234"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-9234",
          "url": "https://www.suse.com/security/cve/CVE-2018-9234"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1088255 for CVE-2018-9234",
          "url": "https://bugzilla.suse.com/1088255"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1090647 for CVE-2018-9234",
          "url": "https://bugzilla.suse.com/1090647"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1217431 for CVE-2018-9234",
          "url": "https://bugzilla.suse.com/1217431"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1217437 for CVE-2018-9234",
          "url": "https://bugzilla.suse.com/1217437"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2018-9234"
    },
    {
      "cve": "CVE-2019-14855",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-14855"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-14855",
          "url": "https://www.suse.com/security/cve/CVE-2019-14855"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1157900 for CVE-2019-14855",
          "url": "https://bugzilla.suse.com/1157900"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1160243 for CVE-2019-14855",
          "url": "https://bugzilla.suse.com/1160243"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181233 for CVE-2019-14855",
          "url": "https://bugzilla.suse.com/1181233"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-14855"
    },
    {
      "cve": "CVE-2020-25125",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-25125"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker\u0027s OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
          "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-25125",
          "url": "https://www.suse.com/security/cve/CVE-2020-25125"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1176034 for CVE-2020-25125",
          "url": "https://bugzilla.suse.com/1176034"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:dirmngr-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-0:2.2.27-2.4.x86_64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.aarch64",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.ppc64le",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.s390x",
            "openSUSE Tumbleweed:gpg2-lang-0:2.2.27-2.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-25125"
    }
  ]
}

CVE-2006-0455 (GCVE-0-2006-0455)

Vulnerability from cvelistv5 – Published: 2006-02-15 22:00 – Updated: 2024-08-07 16:34

Summary

gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded. Note: this also occurs when running the equivalent command "gpg --verify".

Severity

No CVSS data available.

CWE

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1128 records in the last 180 days details

References

32 references

URL	Tags
http://www.securityfocus.com/bid/16663	vdb-entryx_refsource_BID
http://secunia.com/advisories/18956	third-party-advisoryx_refsource_SECUNIA
http://www.trustix.org/errata/2006/0008	vendor-advisoryx_refsource_TRUSTIX
http://marc.info/?l=gnupg-devel&m=113999098729114&w=2	mailing-listx_refsource_MLIST
http://www.openpkg.org/security/OpenPKG-SA-2006.0…	vendor-advisoryx_refsource_OPENPKG
http://secunia.com/advisories/19249	third-party-advisoryx_refsource_SECUNIA
http://www.novell.com/linux/security/advisories/2…	vendor-advisoryx_refsource_SUSE
http://www.redhat.com/support/errata/RHSA-2006-02…	vendor-advisoryx_refsource_REDHAT
http://www.novell.com/linux/security/advisories/2…	vendor-advisoryx_refsource_SUSE
ftp://patches.sgi.com/support/free/security/advis…	vendor-advisoryx_refsource_SGI
http://www.securityfocus.com/archive/1/425289/100…	mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/18934	third-party-advisoryx_refsource_SECUNIA
http://fedoranews.org/updates/FEDORA-2006-116.shtml	vendor-advisoryx_refsource_FEDORA
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.slackware.com/security/viewer.php?l=sl…	vendor-advisoryx_refsource_SLACKWARE
http://www.securityfocus.com/archive/1/433931/100…	vendor-advisoryx_refsource_FEDORA
http://secunia.com/advisories/18955	third-party-advisoryx_refsource_SECUNIA
http://lists.gnupg.org/pipermail/gnupg-announce/2…	mailing-listx_refsource_MLIST
http://www.novell.com/linux/security/advisories/2…	vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/19130	third-party-advisoryx_refsource_SECUNIA
http://www.gentoo.org/security/en/glsa/glsa-20060…	vendor-advisoryx_refsource_GENTOO
http://secunia.com/advisories/19532	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/18933	third-party-advisoryx_refsource_SECUNIA
http://www.us.debian.org/security/2006/dsa-978	vendor-advisoryx_refsource_DEBIAN
http://www.osvdb.org/23221	vdb-entryx_refsource_OSVDB
http://www.ubuntu.com/usn/usn-252-1	vendor-advisoryx_refsource_UBUNTU
http://secunia.com/advisories/18968	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/18845	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/18942	third-party-advisoryx_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.vupen.com/english/advisories/2006/0610	vdb-entryx_refsource_VUPEN

Date Public

2006-02-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:34:14.838Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "16663",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/16663"
          },
          {
            "name": "18956",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18956"
          },
          {
            "name": "2006-0008",
            "tags": [
              "vendor-advisory",
              "x_refsource_TRUSTIX",
              "x_transferred"
            ],
            "url": "http://www.trustix.org/errata/2006/0008"
          },
          {
            "name": "[gnupg-devel] 20060215 [Announce] False positive signature verification in GnuPG",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=gnupg-devel\u0026m=113999098729114\u0026w=2"
          },
          {
            "name": "OpenPKG-SA-2006.001",
            "tags": [
              "vendor-advisory",
              "x_refsource_OPENPKG",
              "x_transferred"
            ],
            "url": "http://www.openpkg.org/security/OpenPKG-SA-2006.001-gnupg.html"
          },
          {
            "name": "19249",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19249"
          },
          {
            "name": "SUSE-SR:2006:005",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2006_05_sr.html"
          },
          {
            "name": "RHSA-2006:0266",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0266.html"
          },
          {
            "name": "SUSE-SA:2006:013",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2006_13_gpg.html"
          },
          {
            "name": "20060401-01-U",
            "tags": [
              "vendor-advisory",
              "x_refsource_SGI",
              "x_transferred"
            ],
            "url": "ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U"
          },
          {
            "name": "20060215 False positive signature verification in GnuPG",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/425289/100/0/threaded"
          },
          {
            "name": "18934",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18934"
          },
          {
            "name": "FEDORA-2006-116",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://fedoranews.org/updates/FEDORA-2006-116.shtml"
          },
          {
            "name": "gnupg-gpgv-improper-verification(24744)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24744"
          },
          {
            "name": "oval:org.mitre.oval:def:10084",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10084"
          },
          {
            "name": "SSA:2006-072-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2006\u0026m=slackware-security.476477"
          },
          {
            "name": "FLSA-2006:185355",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/433931/100/0/threaded"
          },
          {
            "name": "18955",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18955"
          },
          {
            "name": "[gnupg-announce] 20060215 False positive signature verification in GnuPG",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000211.html"
          },
          {
            "name": "SUSE-SA:2006:009",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2006_09_gpg.html"
          },
          {
            "name": "19130",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19130"
          },
          {
            "name": "GLSA-200602-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://www.gentoo.org/security/en/glsa/glsa-200602-10.xml"
          },
          {
            "name": "19532",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19532"
          },
          {
            "name": "18933",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18933"
          },
          {
            "name": "DSA-978",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.us.debian.org/security/2006/dsa-978"
          },
          {
            "name": "23221",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/23221"
          },
          {
            "name": "USN-252-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-252-1"
          },
          {
            "name": "18968",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18968"
          },
          {
            "name": "18845",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18845"
          },
          {
            "name": "18942",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18942"
          },
          {
            "name": "MDKSA-2006:043",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:043"
          },
          {
            "name": "ADV-2006-0610",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/0610"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-02-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded.  Note: this also occurs when running the equivalent command \"gpg --verify\"."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T14:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "16663",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/16663"
        },
        {
          "name": "18956",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18956"
        },
        {
          "name": "2006-0008",
          "tags": [
            "vendor-advisory",
            "x_refsource_TRUSTIX"
          ],
          "url": "http://www.trustix.org/errata/2006/0008"
        },
        {
          "name": "[gnupg-devel] 20060215 [Announce] False positive signature verification in GnuPG",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=gnupg-devel\u0026m=113999098729114\u0026w=2"
        },
        {
          "name": "OpenPKG-SA-2006.001",
          "tags": [
            "vendor-advisory",
            "x_refsource_OPENPKG"
          ],
          "url": "http://www.openpkg.org/security/OpenPKG-SA-2006.001-gnupg.html"
        },
        {
          "name": "19249",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19249"
        },
        {
          "name": "SUSE-SR:2006:005",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2006_05_sr.html"
        },
        {
          "name": "RHSA-2006:0266",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2006-0266.html"
        },
        {
          "name": "SUSE-SA:2006:013",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2006_13_gpg.html"
        },
        {
          "name": "20060401-01-U",
          "tags": [
            "vendor-advisory",
            "x_refsource_SGI"
          ],
          "url": "ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U"
        },
        {
          "name": "20060215 False positive signature verification in GnuPG",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/425289/100/0/threaded"
        },
        {
          "name": "18934",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18934"
        },
        {
          "name": "FEDORA-2006-116",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://fedoranews.org/updates/FEDORA-2006-116.shtml"
        },
        {
          "name": "gnupg-gpgv-improper-verification(24744)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24744"
        },
        {
          "name": "oval:org.mitre.oval:def:10084",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10084"
        },
        {
          "name": "SSA:2006-072-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2006\u0026m=slackware-security.476477"
        },
        {
          "name": "FLSA-2006:185355",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://www.securityfocus.com/archive/1/433931/100/0/threaded"
        },
        {
          "name": "18955",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18955"
        },
        {
          "name": "[gnupg-announce] 20060215 False positive signature verification in GnuPG",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000211.html"
        },
        {
          "name": "SUSE-SA:2006:009",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2006_09_gpg.html"
        },
        {
          "name": "19130",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19130"
        },
        {
          "name": "GLSA-200602-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://www.gentoo.org/security/en/glsa/glsa-200602-10.xml"
        },
        {
          "name": "19532",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19532"
        },
        {
          "name": "18933",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18933"
        },
        {
          "name": "DSA-978",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.us.debian.org/security/2006/dsa-978"
        },
        {
          "name": "23221",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/23221"
        },
        {
          "name": "USN-252-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-252-1"
        },
        {
          "name": "18968",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18968"
        },
        {
          "name": "18845",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18845"
        },
        {
          "name": "18942",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18942"
        },
        {
          "name": "MDKSA-2006:043",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:043"
        },
        {
          "name": "ADV-2006-0610",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/0610"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2006-0455",
    "datePublished": "2006-02-15T22:00:00.000Z",
    "dateReserved": "2006-01-27T00:00:00.000Z",
    "dateUpdated": "2024-08-07T16:34:14.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2006-3746 (GCVE-0-2006-3746)

Vulnerability from cvelistv5 – Published: 2006-07-28 21:00 – Updated: 2024-08-07 18:39

Summary

Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.

Severity

No CVSS data available.

CWE

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1128 records in the last 180 days details

References

36 references

URL	Tags
ftp://patches.sgi.com/support/free/security/advis…	vendor-advisoryx_refsource_SGI
http://secunia.com/advisories/21329	third-party-advisoryx_refsource_SECUNIA
http://www.redhat.com/support/errata/RHSA-2006-06…	vendor-advisoryx_refsource_REDHAT
http://bugs.debian.org/cgi-bin/bugreport.cgi/gnup…	x_refsource_MISC
http://secunia.com/advisories/21297	third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2006/3123	vdb-entryx_refsource_VUPEN
http://www.novell.com/linux/security/advisories/2…	vendor-advisoryx_refsource_SUSE
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://secunia.com/advisories/21300	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/21326	third-party-advisoryx_refsource_SECUNIA
http://issues.rpath.com/browse/RPL-560	x_refsource_MISC
http://secunia.com/advisories/21598	third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://secunia.com/advisories/21467	third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2006/dsa-1140	vendor-advisoryx_refsource_DEBIAN
http://www.securityfocus.com/bid/19110	vdb-entryx_refsource_BID
http://secunia.com/advisories/21351	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/21522	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/21333	third-party-advisoryx_refsource_SECUNIA
http://support.avaya.com/elmodocs2/security/ASA-2…	x_refsource_CONFIRM
https://bugzilla.redhat.com/bugzilla/show_bug.cgi…	x_refsource_MISC
http://www.gossamer-threads.com/lists/gnupg/devel/37623	mailing-listx_refsource_MLIST
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://lists.immunitysec.com/pipermail/dailydave/…	mailing-listx_refsource_MLIST
http://www.ubuntu.com/usn/usn-332-1	vendor-advisoryx_refsource_UBUNTU
http://secunia.com/advisories/21378	third-party-advisoryx_refsource_SECUNIA
http://securitytracker.com/id?1016622	vdb-entryx_refsource_SECTRACK
http://www.osvdb.org/27664	vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/21346	third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/archive/1/442621/100…	mailing-listx_refsource_BUGTRAQ
http://security.gentoo.org/glsa/glsa-200608-08.xml	vendor-advisoryx_refsource_GENTOO
http://www.debian.org/security/2006/dsa-1141	vendor-advisoryx_refsource_DEBIAN
http://www.securityfocus.com/archive/1/442012/100…	mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/21306	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/21524	third-party-advisoryx_refsource_SECUNIA
http://lwn.net/Alerts/194228/	vendor-advisoryx_refsource_TRUSTIX

Date Public

2006-07-22 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T18:39:54.003Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20060801-01-P",
            "tags": [
              "vendor-advisory",
              "x_refsource_SGI",
              "x_transferred"
            ],
            "url": "ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P"
          },
          {
            "name": "21329",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21329"
          },
          {
            "name": "RHSA-2006:0615",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0615.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi/gnupg.CVE-2006-3746.diff?bug=381204%3Bmsg=15%3Batt=1"
          },
          {
            "name": "21297",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21297"
          },
          {
            "name": "ADV-2006-3123",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/3123"
          },
          {
            "name": "SUSE-SR:2006:020",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2006_20_sr.html"
          },
          {
            "name": "oval:org.mitre.oval:def:11347",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11347"
          },
          {
            "name": "21300",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21300"
          },
          {
            "name": "21326",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21326"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://issues.rpath.com/browse/RPL-560"
          },
          {
            "name": "21598",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21598"
          },
          {
            "name": "gnupg-parsecomment-bo(28220)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28220"
          },
          {
            "name": "21467",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21467"
          },
          {
            "name": "DSA-1140",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2006/dsa-1140"
          },
          {
            "name": "19110",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/19110"
          },
          {
            "name": "21351",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21351"
          },
          {
            "name": "21522",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21522"
          },
          {
            "name": "21333",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21333"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2006-164.htm"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=200502"
          },
          {
            "name": "[Gnupg-devel] 20060725 Re: [Dailydave] GnuPG 1.4.4 fun",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.gossamer-threads.com/lists/gnupg/devel/37623"
          },
          {
            "name": "MDKSA-2006:141",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:141"
          },
          {
            "name": "[Dailydave] 20060721 GnuPG 1.4.4 fun",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.immunitysec.com/pipermail/dailydave/2006-July/003354.html"
          },
          {
            "name": "USN-332-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-332-1"
          },
          {
            "name": "21378",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21378"
          },
          {
            "name": "1016622",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1016622"
          },
          {
            "name": "27664",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/27664"
          },
          {
            "name": "21346",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21346"
          },
          {
            "name": "20060808 ERRATA: [ GLSA 200608-08 ] GnuPG: Integer overflow vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/442621/100/100/threaded"
          },
          {
            "name": "GLSA-200608-08",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200608-08.xml"
          },
          {
            "name": "DSA-1141",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2006/dsa-1141"
          },
          {
            "name": "20060802 rPSA-2006-0143-1 gnupg",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/442012/100/0/threaded"
          },
          {
            "name": "21306",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21306"
          },
          {
            "name": "21524",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21524"
          },
          {
            "name": "2006-0044",
            "tags": [
              "vendor-advisory",
              "x_refsource_TRUSTIX",
              "x_transferred"
            ],
            "url": "http://lwn.net/Alerts/194228/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-07-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "20060801-01-P",
          "tags": [
            "vendor-advisory",
            "x_refsource_SGI"
          ],
          "url": "ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P"
        },
        {
          "name": "21329",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21329"
        },
        {
          "name": "RHSA-2006:0615",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2006-0615.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi/gnupg.CVE-2006-3746.diff?bug=381204%3Bmsg=15%3Batt=1"
        },
        {
          "name": "21297",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21297"
        },
        {
          "name": "ADV-2006-3123",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/3123"
        },
        {
          "name": "SUSE-SR:2006:020",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2006_20_sr.html"
        },
        {
          "name": "oval:org.mitre.oval:def:11347",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11347"
        },
        {
          "name": "21300",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21300"
        },
        {
          "name": "21326",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21326"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://issues.rpath.com/browse/RPL-560"
        },
        {
          "name": "21598",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21598"
        },
        {
          "name": "gnupg-parsecomment-bo(28220)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28220"
        },
        {
          "name": "21467",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21467"
        },
        {
          "name": "DSA-1140",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2006/dsa-1140"
        },
        {
          "name": "19110",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/19110"
        },
        {
          "name": "21351",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21351"
        },
        {
          "name": "21522",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21522"
        },
        {
          "name": "21333",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21333"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2006-164.htm"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=200502"
        },
        {
          "name": "[Gnupg-devel] 20060725 Re: [Dailydave] GnuPG 1.4.4 fun",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.gossamer-threads.com/lists/gnupg/devel/37623"
        },
        {
          "name": "MDKSA-2006:141",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:141"
        },
        {
          "name": "[Dailydave] 20060721 GnuPG 1.4.4 fun",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.immunitysec.com/pipermail/dailydave/2006-July/003354.html"
        },
        {
          "name": "USN-332-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-332-1"
        },
        {
          "name": "21378",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21378"
        },
        {
          "name": "1016622",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1016622"
        },
        {
          "name": "27664",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/27664"
        },
        {
          "name": "21346",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21346"
        },
        {
          "name": "20060808 ERRATA: [ GLSA 200608-08 ] GnuPG: Integer overflow vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/442621/100/100/threaded"
        },
        {
          "name": "GLSA-200608-08",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200608-08.xml"
        },
        {
          "name": "DSA-1141",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2006/dsa-1141"
        },
        {
          "name": "20060802 rPSA-2006-0143-1 gnupg",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/442012/100/0/threaded"
        },
        {
          "name": "21306",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21306"
        },
        {
          "name": "21524",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21524"
        },
        {
          "name": "2006-0044",
          "tags": [
            "vendor-advisory",
            "x_refsource_TRUSTIX"
          ],
          "url": "http://lwn.net/Alerts/194228/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2006-3746",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20060801-01-P",
              "refsource": "SGI",
              "url": "ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P"
            },
            {
              "name": "21329",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21329"
            },
            {
              "name": "RHSA-2006:0615",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2006-0615.html"
            },
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi/gnupg.CVE-2006-3746.diff?bug=381204;msg=15;att=1",
              "refsource": "MISC",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi/gnupg.CVE-2006-3746.diff?bug=381204;msg=15;att=1"
            },
            {
              "name": "21297",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21297"
            },
            {
              "name": "ADV-2006-3123",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/3123"
            },
            {
              "name": "SUSE-SR:2006:020",
              "refsource": "SUSE",
              "url": "http://www.novell.com/linux/security/advisories/2006_20_sr.html"
            },
            {
              "name": "oval:org.mitre.oval:def:11347",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11347"
            },
            {
              "name": "21300",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21300"
            },
            {
              "name": "21326",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21326"
            },
            {
              "name": "http://issues.rpath.com/browse/RPL-560",
              "refsource": "MISC",
              "url": "http://issues.rpath.com/browse/RPL-560"
            },
            {
              "name": "21598",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21598"
            },
            {
              "name": "gnupg-parsecomment-bo(28220)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28220"
            },
            {
              "name": "21467",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21467"
            },
            {
              "name": "DSA-1140",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2006/dsa-1140"
            },
            {
              "name": "19110",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/19110"
            },
            {
              "name": "21351",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21351"
            },
            {
              "name": "21522",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21522"
            },
            {
              "name": "21333",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21333"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2006-164.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2006-164.htm"
            },
            {
              "name": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=200502",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=200502"
            },
            {
              "name": "[Gnupg-devel] 20060725 Re: [Dailydave] GnuPG 1.4.4 fun",
              "refsource": "MLIST",
              "url": "http://www.gossamer-threads.com/lists/gnupg/devel/37623"
            },
            {
              "name": "MDKSA-2006:141",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:141"
            },
            {
              "name": "[Dailydave] 20060721 GnuPG 1.4.4 fun",
              "refsource": "MLIST",
              "url": "http://lists.immunitysec.com/pipermail/dailydave/2006-July/003354.html"
            },
            {
              "name": "USN-332-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/usn-332-1"
            },
            {
              "name": "21378",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21378"
            },
            {
              "name": "1016622",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1016622"
            },
            {
              "name": "27664",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/27664"
            },
            {
              "name": "21346",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21346"
            },
            {
              "name": "20060808 ERRATA: [ GLSA 200608-08 ] GnuPG: Integer overflow vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/442621/100/100/threaded"
            },
            {
              "name": "GLSA-200608-08",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200608-08.xml"
            },
            {
              "name": "DSA-1141",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2006/dsa-1141"
            },
            {
              "name": "20060802 rPSA-2006-0143-1 gnupg",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/442012/100/0/threaded"
            },
            {
              "name": "21306",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21306"
            },
            {
              "name": "21524",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21524"
            },
            {
              "name": "2006-0044",
              "refsource": "TRUSTIX",
              "url": "http://lwn.net/Alerts/194228/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2006-3746",
    "datePublished": "2006-07-28T21:00:00.000Z",
    "dateReserved": "2006-07-20T00:00:00.000Z",
    "dateUpdated": "2024-08-07T18:39:54.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2006-6169 (GCVE-0-2006-6169)

Vulnerability from cvelistv5 – Published: 2006-11-29 18:00 – Updated: 2024-08-07 20:19

Summary

Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2261 records in the last 180 days details

References

34 references

URL	Tags
http://secunia.com/advisories/23110	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23269	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23303	third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/archive/1/452829/100…	mailing-listx_refsource_BUGTRAQ
https://issues.rpath.com/browse/RPL-826	x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://secunia.com/advisories/23513	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23284	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23146	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/23171	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/usn-393-2	vendor-advisoryx_refsource_UBUNTU
http://www.redhat.com/support/errata/RHSA-2006-07…	vendor-advisoryx_refsource_REDHAT
http://www.trustix.org/errata/2006/0068/	vendor-advisoryx_refsource_TRUSTIX
http://securityreason.com/securityalert/1927	third-party-advisoryx_refsource_SREASON
http://www.debian.org/security/2006/dsa-1231	vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/23299	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/usn-389-1	vendor-advisoryx_refsource_UBUNTU
https://bugs.g10code.com/gnupg/issue728	x_refsource_MISC
http://securitytracker.com/id?1017291	vdb-entryx_refsource_SECTRACK
http://security.gentoo.org/glsa/glsa-200612-03.xml	vendor-advisoryx_refsource_GENTOO
http://lists.gnupg.org/pipermail/gnupg-announce/2…	mailing-listx_refsource_MLIST
http://secunia.com/advisories/23094	third-party-advisoryx_refsource_SECUNIA
http://lists.suse.com/archive/suse-security-annou…	vendor-advisoryx_refsource_SUSE
http://support.avaya.com/elmodocs2/security/ASA-2…	x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/453253/100…	mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/21306	vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2006/4736	vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/23250	third-party-advisoryx_refsource_SECUNIA
ftp://patches.sgi.com/support/free/security/advis…	vendor-advisoryx_refsource_SGI
http://secunia.com/advisories/23161	third-party-advisoryx_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.openpkg.com/security/advisories/OpenPK…	vendor-advisoryx_refsource_OPENPKG
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://secunia.com/advisories/24047	third-party-advisoryx_refsource_SECUNIA

Date Public

2006-11-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T20:19:34.866Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "23110",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23110"
          },
          {
            "name": "23269",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23269"
          },
          {
            "name": "23303",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23303"
          },
          {
            "name": "20061127 GnuPG 1.4 and 2.0 buffer overflow",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/452829/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.rpath.com/browse/RPL-826"
          },
          {
            "name": "gnupg-openfile-bo(30550)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30550"
          },
          {
            "name": "23513",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23513"
          },
          {
            "name": "23284",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23284"
          },
          {
            "name": "23146",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23146"
          },
          {
            "name": "23171",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23171"
          },
          {
            "name": "USN-393-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-393-2"
          },
          {
            "name": "RHSA-2006:0754",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0754.html"
          },
          {
            "name": "2006-0068",
            "tags": [
              "vendor-advisory",
              "x_refsource_TRUSTIX",
              "x_transferred"
            ],
            "url": "http://www.trustix.org/errata/2006/0068/"
          },
          {
            "name": "1927",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/1927"
          },
          {
            "name": "DSA-1231",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2006/dsa-1231"
          },
          {
            "name": "23299",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23299"
          },
          {
            "name": "USN-389-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-389-1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.g10code.com/gnupg/issue728"
          },
          {
            "name": "1017291",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1017291"
          },
          {
            "name": "GLSA-200612-03",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200612-03.xml"
          },
          {
            "name": "[gnupg-announce] 20061127 GnuPG 1.4 and 2.0 buffer overflow",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html"
          },
          {
            "name": "23094",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23094"
          },
          {
            "name": "SUSE-SA:2006:075",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm"
          },
          {
            "name": "20061201 rPSA-2006-0224-1 gnupg",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/453253/100/100/threaded"
          },
          {
            "name": "21306",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/21306"
          },
          {
            "name": "ADV-2006-4736",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/4736"
          },
          {
            "name": "23250",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23250"
          },
          {
            "name": "20061201-01-P",
            "tags": [
              "vendor-advisory",
              "x_refsource_SGI",
              "x_transferred"
            ],
            "url": "ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc"
          },
          {
            "name": "23161",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23161"
          },
          {
            "name": "MDKSA-2006:221",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:221"
          },
          {
            "name": "OpenPKG-SA-2006.037",
            "tags": [
              "vendor-advisory",
              "x_refsource_OPENPKG",
              "x_transferred"
            ],
            "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html"
          },
          {
            "name": "oval:org.mitre.oval:def:11228",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11228"
          },
          {
            "name": "24047",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/24047"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-11-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with \"C-escape\" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "23110",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23110"
        },
        {
          "name": "23269",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23269"
        },
        {
          "name": "23303",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23303"
        },
        {
          "name": "20061127 GnuPG 1.4 and 2.0 buffer overflow",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/452829/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.rpath.com/browse/RPL-826"
        },
        {
          "name": "gnupg-openfile-bo(30550)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30550"
        },
        {
          "name": "23513",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23513"
        },
        {
          "name": "23284",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23284"
        },
        {
          "name": "23146",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23146"
        },
        {
          "name": "23171",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23171"
        },
        {
          "name": "USN-393-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-393-2"
        },
        {
          "name": "RHSA-2006:0754",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2006-0754.html"
        },
        {
          "name": "2006-0068",
          "tags": [
            "vendor-advisory",
            "x_refsource_TRUSTIX"
          ],
          "url": "http://www.trustix.org/errata/2006/0068/"
        },
        {
          "name": "1927",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/1927"
        },
        {
          "name": "DSA-1231",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2006/dsa-1231"
        },
        {
          "name": "23299",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23299"
        },
        {
          "name": "USN-389-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-389-1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.g10code.com/gnupg/issue728"
        },
        {
          "name": "1017291",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1017291"
        },
        {
          "name": "GLSA-200612-03",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200612-03.xml"
        },
        {
          "name": "[gnupg-announce] 20061127 GnuPG 1.4 and 2.0 buffer overflow",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html"
        },
        {
          "name": "23094",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23094"
        },
        {
          "name": "SUSE-SA:2006:075",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm"
        },
        {
          "name": "20061201 rPSA-2006-0224-1 gnupg",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/453253/100/100/threaded"
        },
        {
          "name": "21306",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/21306"
        },
        {
          "name": "ADV-2006-4736",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/4736"
        },
        {
          "name": "23250",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23250"
        },
        {
          "name": "20061201-01-P",
          "tags": [
            "vendor-advisory",
            "x_refsource_SGI"
          ],
          "url": "ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc"
        },
        {
          "name": "23161",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23161"
        },
        {
          "name": "MDKSA-2006:221",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:221"
        },
        {
          "name": "OpenPKG-SA-2006.037",
          "tags": [
            "vendor-advisory",
            "x_refsource_OPENPKG"
          ],
          "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html"
        },
        {
          "name": "oval:org.mitre.oval:def:11228",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11228"
        },
        {
          "name": "24047",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/24047"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-6169",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with \"C-escape\" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "23110",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23110"
            },
            {
              "name": "23269",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23269"
            },
            {
              "name": "23303",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23303"
            },
            {
              "name": "20061127 GnuPG 1.4 and 2.0 buffer overflow",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/452829/100/0/threaded"
            },
            {
              "name": "https://issues.rpath.com/browse/RPL-826",
              "refsource": "CONFIRM",
              "url": "https://issues.rpath.com/browse/RPL-826"
            },
            {
              "name": "gnupg-openfile-bo(30550)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30550"
            },
            {
              "name": "23513",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23513"
            },
            {
              "name": "23284",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23284"
            },
            {
              "name": "23146",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23146"
            },
            {
              "name": "23171",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23171"
            },
            {
              "name": "USN-393-2",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/usn-393-2"
            },
            {
              "name": "RHSA-2006:0754",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2006-0754.html"
            },
            {
              "name": "2006-0068",
              "refsource": "TRUSTIX",
              "url": "http://www.trustix.org/errata/2006/0068/"
            },
            {
              "name": "1927",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/1927"
            },
            {
              "name": "DSA-1231",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2006/dsa-1231"
            },
            {
              "name": "23299",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23299"
            },
            {
              "name": "USN-389-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/usn-389-1"
            },
            {
              "name": "https://bugs.g10code.com/gnupg/issue728",
              "refsource": "MISC",
              "url": "https://bugs.g10code.com/gnupg/issue728"
            },
            {
              "name": "1017291",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1017291"
            },
            {
              "name": "GLSA-200612-03",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200612-03.xml"
            },
            {
              "name": "[gnupg-announce] 20061127 GnuPG 1.4 and 2.0 buffer overflow",
              "refsource": "MLIST",
              "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html"
            },
            {
              "name": "23094",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23094"
            },
            {
              "name": "SUSE-SA:2006:075",
              "refsource": "SUSE",
              "url": "http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm"
            },
            {
              "name": "20061201 rPSA-2006-0224-1 gnupg",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/453253/100/100/threaded"
            },
            {
              "name": "21306",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/21306"
            },
            {
              "name": "ADV-2006-4736",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/4736"
            },
            {
              "name": "23250",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23250"
            },
            {
              "name": "20061201-01-P",
              "refsource": "SGI",
              "url": "ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc"
            },
            {
              "name": "23161",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23161"
            },
            {
              "name": "MDKSA-2006:221",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:221"
            },
            {
              "name": "OpenPKG-SA-2006.037",
              "refsource": "OPENPKG",
              "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html"
            },
            {
              "name": "oval:org.mitre.oval:def:11228",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11228"
            },
            {
              "name": "24047",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/24047"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-6169",
    "datePublished": "2006-11-29T18:00:00.000Z",
    "dateReserved": "2006-11-29T00:00:00.000Z",
    "dateUpdated": "2024-08-07T20:19:34.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2008-1530 (GCVE-0-2008-1530)

Vulnerability from cvelistv5 – Published: 2008-03-27 23:00 – Updated: 2024-08-07 08:24

Summary

GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs."

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2261 records in the last 180 days details

References

8 references

URL	Tags
http://www.vupen.com/english/advisories/2008/1056…	vdb-entryx_refsource_VUPEN
http://lists.gnupg.org/pipermail/gnupg-announce/2…	mailing-listx_refsource_MLIST
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.ocert.org/advisories/ocert-2008-1.html	x_refsource_MISC
http://www.securityfocus.com/bid/28487	vdb-entryx_refsource_BID
https://bugs.g10code.com/gnupg/issue894	x_refsource_CONFIRM
https://bugs.gentoo.org/show_bug.cgi?id=214990	x_refsource_CONFIRM
http://secunia.com/advisories/29568	third-party-advisoryx_refsource_SECUNIA

Date Public

2008-03-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T08:24:42.576Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2008-1056",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1056/references"
          },
          {
            "name": "[Announce] 20080326 GnuPG 1.4.9 released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2008q1/000272.html"
          },
          {
            "name": "gnupg-keys-code-execution(41547)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41547"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ocert.org/advisories/ocert-2008-1.html"
          },
          {
            "name": "28487",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/28487"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.g10code.com/gnupg/issue894"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.gentoo.org/show_bug.cgi?id=214990"
          },
          {
            "name": "29568",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29568"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-03-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers \"memory corruption around deduplication of user IDs.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T12:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "ADV-2008-1056",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1056/references"
        },
        {
          "name": "[Announce] 20080326 GnuPG 1.4.9 released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2008q1/000272.html"
        },
        {
          "name": "gnupg-keys-code-execution(41547)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41547"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ocert.org/advisories/ocert-2008-1.html"
        },
        {
          "name": "28487",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/28487"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.g10code.com/gnupg/issue894"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.gentoo.org/show_bug.cgi?id=214990"
        },
        {
          "name": "29568",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29568"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-1530",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers \"memory corruption around deduplication of user IDs.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2008-1056",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1056/references"
            },
            {
              "name": "[Announce] 20080326 GnuPG 1.4.9 released",
              "refsource": "MLIST",
              "url": "http://lists.gnupg.org/pipermail/gnupg-announce/2008q1/000272.html"
            },
            {
              "name": "gnupg-keys-code-execution(41547)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41547"
            },
            {
              "name": "http://www.ocert.org/advisories/ocert-2008-1.html",
              "refsource": "MISC",
              "url": "http://www.ocert.org/advisories/ocert-2008-1.html"
            },
            {
              "name": "28487",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/28487"
            },
            {
              "name": "https://bugs.g10code.com/gnupg/issue894",
              "refsource": "CONFIRM",
              "url": "https://bugs.g10code.com/gnupg/issue894"
            },
            {
              "name": "https://bugs.gentoo.org/show_bug.cgi?id=214990",
              "refsource": "CONFIRM",
              "url": "https://bugs.gentoo.org/show_bug.cgi?id=214990"
            },
            {
              "name": "29568",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29568"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-1530",
    "datePublished": "2008-03-27T23:00:00.000Z",
    "dateReserved": "2008-03-27T00:00:00.000Z",
    "dateUpdated": "2024-08-07T08:24:42.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-12020 (GCVE-0-2018-12020)

Vulnerability from cvelistv5 – Published: 2018-06-08 21:00 – Updated: 2024-08-05 08:24

Summary

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2261 records in the last 180 days details

References

21 references

URL	Tags
https://usn.ubuntu.com/3675-2/	vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2018:2180	vendor-advisoryx_refsource_REDHAT
https://lists.gnupg.org/pipermail/gnupg-announce/…	x_refsource_MISC
http://openwall.com/lists/oss-security/2018/06/08/2	x_refsource_MISC
https://www.debian.org/security/2018/dsa-4222	vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/errata/RHSA-2018:2181	vendor-advisoryx_refsource_REDHAT
https://help.ecostruxureit.com/display/public/UAD…	x_refsource_CONFIRM
https://www.debian.org/security/2018/dsa-4224	vendor-advisoryx_refsource_DEBIAN
http://www.securityfocus.com/bid/104450	vdb-entryx_refsource_BID
https://www.debian.org/security/2018/dsa-4223	vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/3675-3/	vendor-advisoryx_refsource_UBUNTU
http://www.securitytracker.com/id/1041051	vdb-entryx_refsource_SECTRACK
https://usn.ubuntu.com/3675-1/	vendor-advisoryx_refsource_UBUNTU
https://dev.gnupg.org/T4012	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2019/04/30/4	mailing-listx_refsource_MLIST
http://seclists.org/fulldisclosure/2019/Apr/38	mailing-listx_refsource_FULLDISC
http://packetstormsecurity.com/files/152703/Johnn…	x_refsource_MISC
https://usn.ubuntu.com/3964-1/	vendor-advisoryx_refsource_UBUNTU
https://github.com/RUB-NDS/Johnny-You-Are-Fired	x_refsource_MISC
https://github.com/RUB-NDS/Johnny-You-Are-Fired/b…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST

Date Public

2018-06-08 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:24:03.773Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-3675-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3675-2/"
          },
          {
            "name": "RHSA-2018:2180",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2180"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2018/06/08/2"
          },
          {
            "name": "DSA-4222",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4222"
          },
          {
            "name": "RHSA-2018:2181",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2181"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
          },
          {
            "name": "DSA-4224",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4224"
          },
          {
            "name": "104450",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104450"
          },
          {
            "name": "DSA-4223",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2018/dsa-4223"
          },
          {
            "name": "USN-3675-3",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3675-3/"
          },
          {
            "name": "1041051",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041051"
          },
          {
            "name": "USN-3675-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3675-1/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/T4012"
          },
          {
            "name": "[oss-security] 20190430 Spoofing OpenPGP and S/MIME Signatures in Emails (multiple clients)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2019/04/30/4"
          },
          {
            "name": "20190430 OpenPGP and S/MIME signature forgery attacks in multiple email clients",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2019/Apr/38"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html"
          },
          {
            "name": "USN-3964-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3964-1/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/RUB-NDS/Johnny-You-Are-Fired"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf"
          },
          {
            "name": "[debian-lts-announce] 20211228 [SECURITY] [DLA 2862-1] python-gnupg security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-06-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-28T22:06:08.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-3675-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3675-2/"
        },
        {
          "name": "RHSA-2018:2180",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2180"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://openwall.com/lists/oss-security/2018/06/08/2"
        },
        {
          "name": "DSA-4222",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4222"
        },
        {
          "name": "RHSA-2018:2181",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2181"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
        },
        {
          "name": "DSA-4224",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4224"
        },
        {
          "name": "104450",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104450"
        },
        {
          "name": "DSA-4223",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2018/dsa-4223"
        },
        {
          "name": "USN-3675-3",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3675-3/"
        },
        {
          "name": "1041051",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041051"
        },
        {
          "name": "USN-3675-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3675-1/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://dev.gnupg.org/T4012"
        },
        {
          "name": "[oss-security] 20190430 Spoofing OpenPGP and S/MIME Signatures in Emails (multiple clients)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2019/04/30/4"
        },
        {
          "name": "20190430 OpenPGP and S/MIME signature forgery attacks in multiple email clients",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2019/Apr/38"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html"
        },
        {
          "name": "USN-3964-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3964-1/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/RUB-NDS/Johnny-You-Are-Fired"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf"
        },
        {
          "name": "[debian-lts-announce] 20211228 [SECURITY] [DLA 2862-1] python-gnupg security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-12020",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-3675-2",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3675-2/"
            },
            {
              "name": "RHSA-2018:2180",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2180"
            },
            {
              "name": "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html",
              "refsource": "MISC",
              "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html"
            },
            {
              "name": "http://openwall.com/lists/oss-security/2018/06/08/2",
              "refsource": "MISC",
              "url": "http://openwall.com/lists/oss-security/2018/06/08/2"
            },
            {
              "name": "DSA-4222",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4222"
            },
            {
              "name": "RHSA-2018:2181",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2181"
            },
            {
              "name": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0",
              "refsource": "CONFIRM",
              "url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
            },
            {
              "name": "DSA-4224",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4224"
            },
            {
              "name": "104450",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104450"
            },
            {
              "name": "DSA-4223",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2018/dsa-4223"
            },
            {
              "name": "USN-3675-3",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3675-3/"
            },
            {
              "name": "1041051",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041051"
            },
            {
              "name": "USN-3675-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3675-1/"
            },
            {
              "name": "https://dev.gnupg.org/T4012",
              "refsource": "MISC",
              "url": "https://dev.gnupg.org/T4012"
            },
            {
              "name": "[oss-security] 20190430 Spoofing OpenPGP and S/MIME Signatures in Emails (multiple clients)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2019/04/30/4"
            },
            {
              "name": "20190430 OpenPGP and S/MIME signature forgery attacks in multiple email clients",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2019/Apr/38"
            },
            {
              "name": "http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html"
            },
            {
              "name": "USN-3964-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3964-1/"
            },
            {
              "name": "https://github.com/RUB-NDS/Johnny-You-Are-Fired",
              "refsource": "MISC",
              "url": "https://github.com/RUB-NDS/Johnny-You-Are-Fired"
            },
            {
              "name": "https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf",
              "refsource": "MISC",
              "url": "https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf"
            },
            {
              "name": "[debian-lts-announce] 20211228 [SECURITY] [DLA 2862-1] python-gnupg security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-12020",
    "datePublished": "2018-06-08T21:00:00.000Z",
    "dateReserved": "2018-06-07T00:00:00.000Z",
    "dateUpdated": "2024-08-05T08:24:03.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-9234 (GCVE-0-2018-9234)

Vulnerability from cvelistv5 – Published: 2018-04-04 00:00 – Updated: 2024-08-05 07:17

Summary

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2261 records in the last 180 days details

References

2 references

URL	Tags
https://dev.gnupg.org/T3844	x_refsource_MISC
https://usn.ubuntu.com/3675-1/	vendor-advisoryx_refsource_UBUNTU

Date Public

2018-04-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:17:52.005Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/T3844"
          },
          {
            "name": "USN-3675-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3675-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-04-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://dev.gnupg.org/T3844"
        },
        {
          "name": "USN-3675-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3675-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-9234",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://dev.gnupg.org/T3844",
              "refsource": "MISC",
              "url": "https://dev.gnupg.org/T3844"
            },
            {
              "name": "USN-3675-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3675-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-9234",
    "datePublished": "2018-04-04T00:00:00.000Z",
    "dateReserved": "2018-04-03T00:00:00.000Z",
    "dateUpdated": "2024-08-05T07:17:52.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-14855 (GCVE-0-2019-14855)

Vulnerability from cvelistv5 – Published: 2020-03-20 00:00 – Updated: 2024-08-05 00:26

Summary

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

Severity

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-326

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1128 records in the last 180 days details

References

5 references

URL	Tags
https://usn.ubuntu.com/4516-1/	vendor-advisory
https://rwc.iacr.org/2020/slides/Leurent.pdf
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…
https://lists.gnupg.org/pipermail/gnupg-announce/…
https://dev.gnupg.org/T4755

Impacted products

1 product

Vendor	Product	Version
Red Hat	gnupg2	Affected: 2.2.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:26:39.140Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-4516-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4516-1/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://rwc.iacr.org/2020/slides/Leurent.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/T4755"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gnupg2",
          "vendor": "Red Hat",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-326",
              "description": "CWE-326",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-07T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "USN-4516-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/4516-1/"
        },
        {
          "url": "https://rwc.iacr.org/2020/slides/Leurent.pdf"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855"
        },
        {
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html"
        },
        {
          "url": "https://dev.gnupg.org/T4755"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2019-14855",
    "datePublished": "2020-03-20T00:00:00.000Z",
    "dateReserved": "2019-08-10T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:26:39.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25125 (GCVE-0-2020-25125)

Vulnerability from cvelistv5 – Published: 2020-09-03 17:48 – Updated: 2024-08-04 15:26

Summary

GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2261 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.opensuse.org/show_bug.cgi?id=1176034	x_refsource_MISC
https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d…	x_refsource_MISC
https://lists.gnupg.org/pipermail/gnupg-announce/…	x_refsource_MISC
https://dev.gnupg.org/T5050	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2020/09/03/4	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2020/09/03/5	mailing-listx_refsource_MLIST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:26:09.468Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.opensuse.org/show_bug.cgi?id=1176034"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://dev.gnupg.org/T5050"
          },
          {
            "name": "[oss-security] 20200903 GNUPG released with AEAD sec fix CVE-2020-25125",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/09/03/4"
          },
          {
            "name": "[oss-security] 20200903 CVE-2020-25125: gnupg2: buffer overflow when importing a key with AEAD preferences",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2020/09/03/5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker\u0027s OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-03T20:06:17.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.opensuse.org/show_bug.cgi?id=1176034"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://dev.gnupg.org/T5050"
        },
        {
          "name": "[oss-security] 20200903 GNUPG released with AEAD sec fix CVE-2020-25125",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/09/03/4"
        },
        {
          "name": "[oss-security] 20200903 CVE-2020-25125: gnupg2: buffer overflow when importing a key with AEAD preferences",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2020/09/03/5"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-25125",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker\u0027s OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.opensuse.org/show_bug.cgi?id=1176034",
              "refsource": "MISC",
              "url": "https://bugzilla.opensuse.org/show_bug.cgi?id=1176034"
            },
            {
              "name": "https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc",
              "refsource": "MISC",
              "url": "https://dev.gnupg.org/rG8ec9573e57866dda5efb4677d4454161517484bc"
            },
            {
              "name": "https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html",
              "refsource": "MISC",
              "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html"
            },
            {
              "name": "https://dev.gnupg.org/T5050",
              "refsource": "MISC",
              "url": "https://dev.gnupg.org/T5050"
            },
            {
              "name": "[oss-security] 20200903 GNUPG released with AEAD sec fix CVE-2020-25125",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/09/03/4"
            },
            {
              "name": "[oss-security] 20200903 CVE-2020-25125: gnupg2: buffer overflow when importing a key with AEAD preferences",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2020/09/03/5"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-25125",
    "datePublished": "2020-09-03T17:48:07.000Z",
    "dateReserved": "2020-09-03T00:00:00.000Z",
    "dateUpdated": "2024-08-04T15:26:09.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2024:10815-1

CVE-2006-0455 (GCVE-0-2006-0455)

CVE-2006-3746 (GCVE-0-2006-3746)

CVE-2006-6169 (GCVE-0-2006-6169)

CVE-2008-1530 (GCVE-0-2008-1530)

CVE-2018-12020 (GCVE-0-2018-12020)

CVE-2018-9234 (GCVE-0-2018-9234)

CVE-2019-14855 (GCVE-0-2019-14855)

CVE-2020-25125 (GCVE-0-2020-25125)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour