-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________ OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security/ http://www.openpkg.org openpkg-security@xxxxxxxxxxx openpkg@xxxxxxxxxxx OpenPKG-SA-2006.010 26-Jun-2006 ________________________________________________________________________ Package: gnupg Vulnerability: denial of service OpenPKG Specific: no Affected Releases: Affected Packages: Corrected Packages: OpenPKG CURRENT <= gnupg-1.4.3-20060403 >= gnupg-1.4.4-20060625 OpenPKG 2.20060622 <= gnupg-1.4.4-2.20060622 >= gnupg-1.4.4-2.20060622 OpenPKG 2.5 <= gnupg-1.4.2-2.5.1 >= gnupg-1.4.2-2.5.2 Description: According to a vendor security release note [0], a memory allocation attack possibility exists in the GnuPG [1] cryptography tool, version 1.4.3 and earlier. The problem allows remote attackers to cause a Denial of Service (DoS) (GnuPG crashes) and possibly overwrite memory via a message packet with a large length, which could lead to an integer overflow, as demonstrated using the "--no-armor" option. The Common Vulnerabilities and Exposures (CVE) project assigned the id CVE-2006-3082 [2] to the problem. ________________________________________________________________________ References: [0] http://lists.gnupg.org/pipermail/gnupg-announce/2006q2/000226.html [1] http://www.gnupg.org/ [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3082 ________________________________________________________________________ For security reasons, this advisory was digitally signed with the OpenPGP public key "OpenPKG <openpkg@xxxxxxxxxxx>" (ID 63C4CB9F) of the OpenPKG project which you can retrieve from http://pgp.openpkg.org and hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org for details on how to verify the integrity of this advisory. ________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Comment: OpenPKG <openpkg@xxxxxxxxxxx> iD8DBQFEn3w1gHWT4GPEy58RAvHNAJ9ic2qU5anYD320UzejXFkfnNGEQgCfVdx+ qSDOaeFyJKJ3Lo2n6MsiR38= =8KLS -----END PGP SIGNATURE-----
