GnuPG key validation fix

A key validation bug which results in all user IDs on a given key being treated with the validity of the most-valid user ID on that key has been fixed with the release of GnuPG 1.2.2. We recommend sites using GnuPG upgrade to this new package. For detailed information about the problem, see this...

Moderate: Red Hat Security Advisory: : Updated gnupg packages fix validation bug

Updated gnupg packages correcting a bug in the GnuPG key validation functions are now available. The GNU Privacy Guard GnuPG is a utility for encrypting data and creating digital signatures. When evaluating trust values for different UIDs assigned to a given key, GnuPG versions earlier than 1.2.2...

GnuPG contains flaw in key validation code

Overview A vulnerability in GnuPG may cause keys with multiple user ID's to give other user IDs on the key a false amount of validity. Description From the GnuPG homepage:GnuPG stands for GNU Privacy Guard and is GNU's tool for secure communication and data storage. It can be used to encrypt data...

CVE-2003-0256

The CVE affects kopete prior to version 0.6.2, specifically its GnuPG plugin. The issue arises because the plugin does not properly sanitize the command line passed to gpg, enabling remote attackers to execute arbitrary commands in the user’s kopete client context by sending specially crafted mes...

CVE-2003-0256

The GnuPG plugin in kopete before 0.6.2 does not properly cleanse the command line when executing gpg, which allows remote attackers to execute arbitrary commands...

CVE-2003-0255

GnuPG contains a vulnerability (CVE-2003-0255) where the key validation logic in versions prior to 1.2.2 incorrectly determines the validity of keys with multiple user IDs, effectively assigning the highest trust value to all UIDs on a key. This can prevent warning prompts when encrypting to a ke...

CVE-2003-0255

The key validation code in GnuPG before 1.2.2 does not properly determine the validity of keys with multiple user IDs and assigns the greatest validity of the most valid user ID, which prevents GnuPG from warning the encrypting user when a user ID does not have a trusted path...

Key spoofing bug in GnuPG

On certain condition message may be encrypted with another user's key without warning...

Key validity bug in GnuPG 1.2.1 and earlier

As part of the development of GnuPG 1.2.2, a bug was discovered in the key validation code. This bug causes keys with more than one user ID to give all user IDs on the key the amount of validity given to the most-valid key. This bug does not impact any key with only one user ID. Photo IDs "user...

GnuPG contains format-string vulnerability in handling of encrypted data filename

Overview Some versions of Gnu Privacy Guard GPG contain a format-string vulnerability from improper handling of filenames when decrypting files. Description GPG is an OpenPGP-compliant alternative to PGP to protect electronic communications using public-key cryptography. Versions of GPG prior to...

CVE-2001-0522

The CVE-2001-0522 issue concerns GnuPG (GPG) versions 1.0.5 and earlier, where a format-string vulnerability in the do_get/tty_printf flow exposes the original encrypted-file filename to format-string processing. This can allow code execution with the privileges of the user decrypting the file. T...

GnuPG format string vulnerability in do_get() in ttyio.c while prompting for a new filename

Overview There is a format string vulnerability in GNU Privacy Guard. By sending a GPG message with a carefully crafted malicious filename, an attacker may be able to execute arbitrary code as the user who decrypts the message. Description GNU Privacy Guard GPG is a free, RFC2440 compliant...

Ошибка форматной строки в GnuPG (format string)

Ошбка форматной строки при отображении имени файла...

FreeBSD-SA-01:44.gnupg

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:44 Security Advisory FreeBSD, Inc. Topic: gnupg contains format string vulnerability Category: ports Module: gnupg Announced: 2001-07-10 Credits: fish stiqz Affects: Port...

[SECURITY] [DSA-061-1] multiple gnupg problems

Package : gnupg Problem type : printf format attack web of trust pollution Debian-specific: no The version of GnuPG GNU Privacy Guard, an OpenPGP implementation as distributed in Debian GNU/Linux 2.2 suffers from two problems: fish stiqz reported on bugtraq that there was a printf format problem ...

[synnergy] - GnuPG remote format string vulnerability

--------------------------------------------------------------------------- Remote arbitrary code execution vulnerability in GnuPG = 1.0.5 Synnergy Networks http://www.synnergy.net/ By: fish stiqz [email protected] Released: 05/29/2001...

GNU Privacy Guard 1.0.x - Format String

source: https://www.securityfocus.com/bid/2797/info GnuPG is a popular open source public/private key encryption system. It is possible for attackers to create an encrypted document that will exploit a format string vulnerability in the GnuPG client when the document is decrypted. This...

GNU Privacy Guard 1.0.x - Format String

GNU Privacy Guard 1.0.x - Format String source: https://www.securityfocus.com/bid/2797/info GnuPG is a popular open source public/private key encryption system. It is possible for attackers to create an encrypted document that will exploit a format string vulnerability in the GnuPG client when th...

CVE-2001-0071

CVE-2001-0071 affects GnuPG (gpg) 1.0.4 and other versions, where the software does not properly verify detached signatures. This is reported to allow an attacker to modify the contents of a file without detection. The connected documents confirm the affected component and the underlying issue bu...

CVE-2001-0072

CVE-2001-0072 is confirmed via multiple connected sources: GnuPG 1.0.4 and related versions import private keys when importing public keys from key servers without notifying the user, potentially corrupting the user’s web of trust. The Mandrake advisory MDKSA-2000:087 notes this behavior and indi...