PT-2006-7571 · Gnu+1 · Gnupg+1

Tavis Ormandy · Published 1970-01-01 · Updated 2018-10-17 · CVE-2006-6235

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GnuPG versions 1.x before 1.4.6 GnuPG versions 2.x before 2.0.2 GnuPG versions 1.9.0 through 1.9.95

Description The issue concerns multiple vulnerabilities in the gpg package that can lead to breaches in confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The vulnerability in GnuPG allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.

Recommendations For GnuPG versions 1.x before 1.4.6, update to version 1.4.6 or later. For GnuPG versions 2.x before 2.0.2, update to version 2.0.2 or later. For GnuPG versions 1.9.0 through 1.9.95, update to a version outside of this range, such as version 1.4.6 or later, or version 2.0.2 or later.

Fix

Related Identifiers

BDU:2015-04219

BDU:2015-04952

BDU:2015-04953

CVE-2006-6235

DSA-1231-1

RHSA-2006:0754

RHSA-2006_0754

Affected Products

Gnupg

Red Hat

References · 46

• http://openpkg.com/security/advisories/OpenPKG-SA-2006.037.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04953 · Security Note
• http://security.gentoo.org/glsa/glsa-200612-03.xml · Vendor Advisory
• http://debian.org/security/2006/dsa-1231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6235 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:228 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_28_sr.html · Vendor Advisory
• http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html · Vendor Advisory
• http://ubuntu.com/usn/usn-393-2 · Vendor Advisory
• http://trustix.org/errata/2006/0070 · Vendor Advisory
• http://secunia.com/advisories/23255 · Vendor Advisory
• http://secunia.com/advisories/23250 · Vendor Advisory
• http://secunia.com/advisories/23245 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6235 · Vendor Advisory