[slackware-security] gnupg [resigned]

Hello,

As many people have pointed out, the last advisory (SSA:2006-340-01)
was not signed with the usual Slackware Security Team key
(fingerprint 40102233). I did some reconfiguration on the box that
does the distribution signing and it had some unintended
side-effects. :-/ Several CHECKSUMS.md5.asc files were also signed
with the wrong key.

The affected CHECKSUMS.md5 files have been resigned and uploaded, and
this announcement has also been signed (and verified :-) using the
usual primary Slackware signing key.

Also, it was noticed that the URL given to lists.gnupg.org was either
incorrect or has changed since the advisory was issued. This error
has also been corrected.

Sorry for any confusion.

Pat

Corrected advisory follows:

[slackware-security] gnupg (SSA:2006-340-01)

New gnupg packages are available for Slackware 9.0, 9.1, 10.0, 10.1,
10.2, and 11.0 to fix security issues.

More details about the issues may be found here:
http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html
https://vulners.com/cve/CVE-2006-6235
https://vulners.com/cve/CVE-2006-6169

Here are the details from the Slackware 11.0 ChangeLog:

patches/packages/gnupg-1.4.6-i486-1_slack11.0.tgz:
Upgraded to gnupg-1.4.6. This release fixes a severe and exploitable
bug in earlier versions of gnupg. All gnupg users should update to the
new packages as soon as possible. For details, see the information
concerning CVE-2006-6235 posted on lists.gnupg.org:
http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html
The CVE entry for this issue may be found here:
https://vulners.com/cve/CVE-2006-6235
This update also addresses a more minor security issue possibly
exploitable when GnuPG is used in interactive mode. For more information
about that issue, see:
https://vulners.com/cve/CVE-2006-6169
(* Security fix *)

Where to find the new packages:

HINT: Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try. This is another primary FTP site
for Slackware that can be considerably faster than downloading
from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating additional FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/gnupg-1.4.6-i386-1_slack9.0.tgz

Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/gnupg-1.4.6-i486-1_slack9.1.tgz

Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/gnupg-1.4.6-i486-1_slack10.0.tgz

Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/gnupg-1.4.6-i486-1_slack10.1.tgz

Updated package for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/gnupg-1.4.6-i486-1_slack10.2.tgz

Updated package for Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/gnupg-1.4.6-i486-1_slack11.0.tgz

MD5 signatures:

Slackware 9.0 package:
bc23c2e8fd1862a3749d7ea9478654e2 gnupg-1.4.6-i386-1_slack9.0.tgz

Slackware 9.1 package:
1ec4938e51b300f332696f76ce5476b5 gnupg-1.4.6-i486-1_slack9.1.tgz

Slackware 10.0 package:
8be8d0094be837dca5274c6ef17d0856 gnupg-1.4.6-i486-1_slack10.0.tgz

Slackware 10.1 package:
bdaf8c564a758fb13faecc8f030a8f3c gnupg-1.4.6-i486-1_slack10.1.tgz

Slackware 10.2 package:
1c9e9f1364086ccdb204d50d0ee87df2 gnupg-1.4.6-i486-1_slack10.2.tgz

Slackware 11.0 package:
8f0cd5490e5a12bddc4be418c6806fa3 gnupg-1.4.6-i486-1_slack11.0.tgz

Installation instructions:

Upgrade the package as root:
> upgradepkg gnupg-1.4.6-i486-1_slack11.0.tgz