remote code execution in gpg

2006-03-1017:18:31

lists.opensuse.org

0.006 Low

EPSS

Percentile

76.0%

JSON

The GNU Privacy Guard (GPG) allows crafting a message which could check out correct using “–verify”, but would extract a different, potentially malicious content when using “-o --batch”.

Solution

There is no known workaround, please install the update packages.

OSVersionArchitecturePackageVersionFilename
openSUSE9.1i586gpg< 1.2.4-68.13gpg-1.2.4-68.13.i586.rpm
openSUSE9.3i586gpg< 1.4.0-4.4gpg-1.4.0-4.4.i586.rpm
openSUSE9.1x86_64gpg< 1.2.4-68.13gpg-1.2.4-68.13.x86_64.rpm
openSUSE10.0i586gpg< 1.4.2-5.4gpg-1.4.2-5.4.i586.rpm
openSUSE9.2x86_64gpg< 1.2.5-3.6gpg-1.2.5-3.6.x86_64.rpm
openSUSE10.0x86_64gpg< 1.4.2-5.4gpg-1.4.2-5.4.x86_64.rpm
openSUSE10.0ppcgpg< 1.4.2-5.4gpg-1.4.2-5.4.ppc.rpm
openSUSE9.2i586gpg< 1.2.5-3.6gpg-1.2.5-3.6.i586.rpm
openSUSE9.3x86_64gpg< 1.4.0-4.4gpg-1.4.0-4.4.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
openSUSE	9.1	i586	gpg	< 1.2.4-68.13	gpg-1.2.4-68.13.i586.rpm
openSUSE	9.3	i586	gpg	< 1.4.0-4.4	gpg-1.4.0-4.4.i586.rpm
openSUSE	9.1	x86_64	gpg	< 1.2.4-68.13	gpg-1.2.4-68.13.x86_64.rpm
openSUSE	10.0	i586	gpg	< 1.4.2-5.4	gpg-1.4.2-5.4.i586.rpm
openSUSE	9.2	x86_64	gpg	< 1.2.5-3.6	gpg-1.2.5-3.6.x86_64.rpm
openSUSE	10.0	x86_64	gpg	< 1.4.2-5.4	gpg-1.4.2-5.4.x86_64.rpm
openSUSE	10.0	ppc	gpg	< 1.4.2-5.4	gpg-1.4.2-5.4.ppc.rpm
openSUSE	9.2	i586	gpg	< 1.2.5-3.6	gpg-1.2.5-3.6.i586.rpm
openSUSE	9.3	x86_64	gpg	< 1.4.0-4.4	gpg-1.4.0-4.4.x86_64.rpm

0.006 Low

EPSS

Percentile

76.0%

JSON

Related for SUSE-SA:2006:014