Debian Gnupg1 vulnerabilities

CVE-2018-12020 [HIGH] CVE-2018-12020: enigmail - mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decrypt... mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjuncti

CVE-2019-14855 [HIGH] CVE-2019-14855: gnupg1 - A flaw was found in the way certificate signatures could be forged using collisi... A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2017-7526 [MEDIUM] CVE-2017-7526: gnupg1 - libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resu... libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware wh

CVE-2018-1000858 [HIGH] CVE-2018-1000858: gnupg1 - GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulner... GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been

CVE-2016-6313 [MEDIUM] CVE-2016-6313: gnupg1 - The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1... The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits. Scope: local bookworm: resolved (fixed in 1.4.21-1) bullseye: resolved (fixed in 1.4.21-1) forky: resolved (fi