A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.
CVSS 2.0
Severity: HIGH
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| gnu | privacy_guard | 1.9.10 |
| redhat | linux_advanced_workstation | 2.1 |
| gnu | privacy_guard | 1.3.4 |
| gnu | privacy_guard | 1.4.2 |
| gnu | privacy_guard | 1.3.3 |
| ubuntu | ubuntu_linux | 6.06 |
| gnu | privacy_guard | 1.4.1 |
| redhat | enterprise_linux | 4.0 |
| redhat | enterprise_linux_desktop | 4.0 |
| gnu | privacy_guard | 1.2.6 |
| gnu | privacy_guard | 1.2.7 |
| gnu | privacy_guard | 1.4.3 |
| gnu | privacy_guard | 2.0 |
| gnu | privacy_guard | 1.4.5 |
| gnu | privacy_guard | 1.9.15 |
| gnu | privacy_guard | 1.4.2.1 |
| redhat | fedora_core | core_5.0 |
| gnu | privacy_guard | 1.2.4 |
| gnu | privacy_guard | 1.4 |
| redhat | fedora_core | core6 |
| gnu | privacy_guard | 1.4.2.2 |
| gnu | privacy_guard | 1.9.20 |
| gpg4win | gpg4win | 1.0.7 |
| redhat | enterprise_linux_desktop | 3.0 |
| ubuntu | ubuntu_linux | 5.10 |
| gnu | privacy_guard | 1.2.5 |
| rpath | linux | 1 |
| slackware | slackware_linux | 11.0 |
| gnu | privacy_guard | 2.0.1 |
| gnu | privacy_guard | 1.4.4 |
gpg2.exe in Gpg4win 2.0.1, as used in KDE Kleopatra 2.0.11, allows remote attackers to cause a denial of service (application crash) via a long certificate signature.
CVSS 2.0
Severity: MEDIUM
Problem Type: NVD-CWE-Other,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| gpg4win | gpg4win | 2.0.1 |