PT-2006-7568 · Suse+2 · Suse Linux Enterprise+6

Tavis Ormandy · Published 1970-01-01 · Updated 2024-06-15 · CVE-2006-0455

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions liby2util versions (affected versions not specified) liby2util-devel versions (affected versions not specified) GnuPG versions prior to 1.4.2.1 gpg versions (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the liby2util, liby2util-devel, and gpg packages of various Linux operating systems, including SUSE Linux Enterprise and openSUSE. These vulnerabilities can be exploited remotely and may lead to a breach of protected information integrity. In the case of GnuPG, the gpgv component may return a 0 exit code even when the detached signature file does not carry a signature, potentially causing programs that use gpgv to incorrectly assume successful signature verification.

Recommendations For liby2util and liby2util-devel, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For GnuPG, update to version 1.4.2.1 or later to resolve the issue. For gpg, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-04149

BDU:2015-04150

BDU:2015-04151

BDU:2015-04817

BDU:2015-04818

CVE-2006-0455

DSA-978-1

OPENSUSE-SU-2024:10815-1

RHSA-2006:0266

RHSA-2006_0266

Affected Products

Gnupg

Red Hat

Suse Linux Enterprise

Gpg

Liby2Util

Liby2Util-Devel

Opensuse

References · 52

• 🔥 http://securityfocus.com/bid/16663 · Exploit
• 🔥 https://exploit-db.com/exploits/27231 · Exploit
• http://openpkg.org/security/OpenPKG-SA-2006.001-gnupg.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0455 · Security Note
• https://bdu.fstec.ru/vul/2015-04817 · Security Note
• http://novell.com/linux/security/advisories/2006_09_gpg.html · Vendor Advisory
• http://secunia.com/advisories/18955 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_13_gpg.html · Vendor Advisory
• http://us.debian.org/security/2006/dsa-978 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200602-10.xml · Vendor Advisory
• http://secunia.com/advisories/18933 · Vendor Advisory
• http://secunia.com/advisories/18934 · Vendor Advisory
• http://ubuntu.com/usn/usn-252-1 · Vendor Advisory
• http://securityfocus.com/archive/1/433931/100/0/threaded · Vendor Advisory
• http://secunia.com/advisories/18942 · Vendor Advisory