Slackware 9.0 : GnuPG key validation fix (SSA:2003-141-04)

A key validation bug which results in all user IDs on a given key being treated with the validity of the most-valid user ID on that key has been fixed with the release of GnuPG 1.2.2. We recommend sites using GnuPG upgrade to this new package. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

FreeBSD-SA-05:16.zlib

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:16.zlib Security Advisory The FreeBSD Project Topic: Buffer overflow in zlib Category: core Module: libz Announced: 2005-07-06 Credits: Tavis Ormandy Affects:...

FreeBSD-SA-05:13.ipfw

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:13.ipfw Security Advisory The FreeBSD Project Topic: ipfw packet matching errors with address tables Category: core Module: netinet Announced: 2005-06-29...

GLSA-200503-29 : GnuPG: OpenPGP protocol attack

The remote host is affected by the vulnerability described in GLSA-200503-29 GnuPG: OpenPGP protocol attack A flaw has been identified in an integrity checking mechanism of the OpenPGP protocol. Impact : An automated system using GnuPG that allows an attacker to repeatedly discover the outcome of...

GnuPG: OpenPGP protocol attack

Background GnuPG is complete and free replacement for PGP, a tool for secure communication and data storage. Description A flaw has been identified in an integrity checking mechanism of the OpenPGP protocol. Impact An automated system using GnuPG that allows an attacker to repeatedly discover the...

OpenPGP/GnuPG chosen ciphertext cryptography attack

With CFB mode encryption attacker can recover part of the plaintext if 2 first bytes of the message block are known...

Mandrake Linux Security Advisory : gnupg (MDKSA-2005:057)

The OpenPGP protocol is vulnerable to a timing-attack in order to gain plain text from cipher text. The timing difference appears as a side effect of the so-called 'quick scan' and is only exploitable on systems that accept an arbitrary amount of cipher text for automatic decryption. The updated...

gnupg -- OpenPGP symmetric encryption vulnerability

Serge Mister and Robert Zuccherato reports that the OpenPGP protocol is vulnerable to a cryptographic attack when using symmetric encryption in an automated way. David Shaw reports about the impact: This attack, while very significant from a cryptographic point of view, is not generally effective...

Debian DSA-061-1 : gnupg - printf format attack

The version of GnuPG GNU Privacy Guard, an OpenPGP implementation as distributed in Debian GNU/Linux 2.2 suffers from two problems : - fish stiqz reported on bugtraq that there was a printf format problem in the doget function: it printed a prompt which included the filename that was being...

Debian DSA-429-1 : gnupg - cryptographic weakness

Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. This update disables the use of this type of key. %NASLMINLEVEL 70300 C Tenable Netwo...

Mandrake Linux Security Advisory : gnupg (MDKSA-2003:061)

A bug was discovered in GnuPG versions 1.2.1 and earlier. When gpg evaluates trust values for different UIDs assigned to a key, it would incorrectly associate the trust value of the UID with the highest trust value with every other UID assigned to that key. This prevents a warning message from...

Mandrake Linux Security Advisory : gnupg (MDKSA-2003:109)

A severe vulnerability was discovered in GnuPG by Phong Nguyen relating to ElGamal sign+encrypt keys. From Werner Koch's email message : 'Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a...

Mandrake Linux Security Advisory : gnupg (MDKSA-2001:053-1)

A format string vulnerability exists in gnupg 1.0.5 and previous versions which is fixed in 1.0.6. This vulnerability can be used to invoke shell commands with privileges of the currently logged-in user. Update : The /usr/bin/gpg executable was installed setuid root and setgid root. While being...

Mandrake Linux Security Advisory : kopete (MDKSA-2003:055)

A vulnerability was discovered in versions of kopete, a KDE instant messenger client, prior to 0.6.2. This vulnerability is in the GnuPG plugin that allows for users to send each other GPG-encrypted instant messages. The plugin passes encrypted messages to gpg, but does no checking to sanitize th...

Mandrake Linux Security Advisory : gnupg (MDKSA-2001:045)

GnuPG version 1.0.5 has been released that fixes a few security problems, including a vulnerability that makes it easier for an attacker to recover your private key if they are able to steal your keyring. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks...

SuSE-SA:2003:048: gpg

The remote host is missing the patch for the advisory SuSE-SA:2003:048 gpg. The gnupg the SUSE package is named gpg package is the most widely used software for cryptographic encryption/decryption of data. Two independent errors have been found in gpg GnuPG packages as shipped with SUSE products:...

Fedora Core 1 : gnupg-1.2.3-2 (2003-025)

Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys, when those keys are used both to sign and encrypt data. This vulnerability can be used to trivially recover the private key. While the default behavior of GnuPG when generating keys does not lead to the creation ...

RHEL 2.1 / 3 : gnupg (RHSA-2003:395)

Updated gnupg packages are now available for Red Hat Enterprise Linux. These updates disable the ability to generate ElGamal keys used for both signing and encrypting and disable the ability to use ElGamal public keys for encrypting data. GnuPG is a utility for encrypting data and creating digita...

RHEL 2.1 : gnupg (RHSA-2003:176)

Updated gnupg packages are now available which correct a bug in the GnuPG key validation functions. The GNU Privacy Guard GnuPG is a utility for encrypting data and creating digital signatures. When evaluating trust values for the UIDs assigned to a given key, GnuPG versions earlier than 1.2.2...

[SECURITY] [DSA 429-2] New gnupg packages fix cryptographic weakness

-------------------------------------------------------------------------- Debian Security Advisory DSA 429-2 [email protected] http://www.debian.org/security/ Matt Zimmerman February 13th, 2004 http://www.debian.org/security/faq -...