Debian Gnupg2 vulnerabilities

CVE-2007-1263 [MEDIUM] CVE-2007-1263: gnupg2 - GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, ... GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection. Scope: local bookworm: resolved (fixed in 2.0.3-1) bullseye: resolved (fixed in 2.0.3-1) forky:

CVE-2006-3746 [MEDIUM] CVE-2006-3746: gnupg2 - Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers t... Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message. Scope: local bookworm: resolved (fixed in 1.9.20-2) bullseye: resolved (fixed in 1.9.20-2) forky: resolved (fixed in 1.9.20-2) sid: resolved (fixed in 1.9.20-2) trixie: resolved (fixed in 1.9.20-2)

CVE-2018-12020 [HIGH] CVE-2018-12020: enigmail - mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decrypt... mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjuncti

CVE-2006-3082 [MEDIUM] CVE-2006-3082: gnupg2 - parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows rem... parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option. Scope: local bookworm: resolved (fixed in 1.9.20-1.1)

CVE-2018-9234 [HIGH] CVE-2018-9234: gnupg2 - GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certificatio... GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. Scope: local bookworm: resolved (fixed in 2.2.7-1) bullseye: resolved (fixed in 2.2.7-1) forky: resolved (fixed in 2.2.7-1) sid: resolved (fixed in

CVE-2006-6235 [CRITICAL] CVE-2006-6235: gnupg2 - A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.... A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory. Scope: local bookworm: resolved (fixed in 2.0.0-5.2) bullseye: resolved (fixed in 2.0.0-5.2) forky: reso

CVE-2019-14855 [HIGH] CVE-2019-14855: gnupg1 - A flaw was found in the way certificate signatures could be forged using collisi... A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2010-2547 [HIGH] CVE-2010-2547: gnupg2 - Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through ... Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature. Scope: lo

CVE-2017-7526 [MEDIUM] CVE-2017-7526: gnupg1 - libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resu... libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware wh

CVE-2014-9087 [HIGH] CVE-2014-9087: gnupg2 - Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as us... Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2022-34903 [MEDIUM] CVE-2022-34903: gnupg2 - GnuPG through 2.3.6, in unusual situations where an attacker possesses any secre... GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line. Scope: local bookworm: resolved (fixed in 2.2.35-3) bullseye: resolved (fixed in 2.2.27-2+deb11u2) forky: resolved (fixed in 2.2.35-

CVE-2018-1000858 [HIGH] CVE-2018-1000858: gnupg1 - GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulner... GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been

CVE-2008-1530 [CRITICAL] CVE-2008-1530: gnupg2 - GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service... GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs." Scope: local bookworm: resolved (fixed in 2.0.9-1) bullseye: resolved (fixed in 2.0.9-1) forky: resolved (fixe

CVE-2025-68973 [HIGH] CVE-2025-68973: gnupg2 - In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an inde... In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.) Scope: local bookworm: resolved (fixed in 2.2.40-1.1+deb12u2) bullseye: resolved (fixed in 2.2.27-2+deb11u3) forky: resolved (fixed in 2.4.8-5) si

CVE-2006-6169 [MEDIUM] CVE-2006-6169: gnupg2 - Heap-based buffer overflow in the ask_outfile_name function in openfile.c for Gn... Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt. Scope: local bookworm: resolved (

CVE-2013-4351 [MEDIUM] CVE-2013-4351: gnupg2 - GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared... GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey. Scope: local bookworm: resolved (fixed in 2.0.22-1) bullseye: resolved (fixed in 2.0.22-1) forky: reso

CVE-2016-6313 [MEDIUM] CVE-2016-6313: gnupg1 - The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1... The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits. Scope: local bookworm: resolved (fixed in 1.4.21-1) bullseye: resolved (fixed in 1.4.21-1) forky: resolved (fi

CVE-2005-2023 [CRITICAL] CVE-2005-2023: gnupg2 - The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 do... The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options, which can prevent pinentry from being found and causes S/MIME signing to fail. Scope: local bookworm: resolved (fixed in 1.9.15-1) bullseye: resolved (fixed in 1.9.15-1) forky: resolved (fixed in 1.9.15-1) sid: resolved (fixed in 1.9.15-1) trixie:

CVE-2013-4402 [MEDIUM] CVE-2013-4402: gnupg2 - The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.2... The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message. Scope: local bookworm: resolved (fixed in 2.0.22-1) bullseye: resolved (fixed in 2.0.22-1) forky: resolved (fixed in 2.0.22-1) sid: resolved (fixed in 2.0.22-1) trixie: resolved (fix

CVE-2012-6085 [MEDIUM] CVE-2012-6085: gnupg2 - The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x t... The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet. Scope: local bookworm: resolved (fixed in 2.0.19-2) bullseye: resolved (fixed in 2.0.19-2)