Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2006-6235

A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.

Published

2006-12-07T11:28:00.000

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 10.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

10.0

Impact Score

10.0

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	gnu	privacy_guard	1.2.4	Yes
Application	gnu	privacy_guard	1.2.5	Yes
Application	gnu	privacy_guard	1.2.6	Yes
Application	gnu	privacy_guard	1.2.7	Yes
Application	gnu	privacy_guard	1.3.3	Yes
Application	gnu	privacy_guard	1.3.4	Yes
Application	gnu	privacy_guard	1.4	Yes
Application	gnu	privacy_guard	1.4.1	Yes
Application	gnu	privacy_guard	1.4.2	Yes
Application	gnu	privacy_guard	1.4.2.1	Yes
Application	gnu	privacy_guard	1.4.2.2	Yes
Application	gnu	privacy_guard	1.4.3	Yes
Application	gnu	privacy_guard	1.4.4	Yes
Application	gnu	privacy_guard	1.4.5	Yes
Application	gnu	privacy_guard	1.9.10	Yes
Application	gnu	privacy_guard	1.9.15	Yes
Application	gnu	privacy_guard	1.9.20	Yes
Application	gnu	privacy_guard	2.0	Yes
Application	gnu	privacy_guard	2.0.1	Yes
Application	gpg4win	gpg4win	1.0.7	Yes
Operating System	redhat	enterprise_linux	4.0	Yes
Operating System	redhat	enterprise_linux	4.0	Yes
Operating System	redhat	enterprise_linux	4.0	Yes
Operating System	redhat	enterprise_linux_desktop	3.0	Yes
Operating System	redhat	enterprise_linux_desktop	4.0	Yes
Operating System	redhat	fedora_core	core_5.0	Yes
Operating System	redhat	fedora_core	core6	Yes
Operating System	redhat	linux_advanced_workstation	2.1	Yes
Operating System	rpath	linux	1	Yes
Operating System	slackware	slackware_linux	11.0	Yes
Operating System	ubuntu	ubuntu_linux	5.10	Yes
Operating System	ubuntu	ubuntu_linux	6.06	Yes

References

ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc ([email protected])
http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html ([email protected])
http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html ([email protected])
http://secunia.com/advisories/23245 Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/23250 Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/23255 Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/23259 ([email protected])
http://secunia.com/advisories/23269 Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/23284 ([email protected])
http://secunia.com/advisories/23290 ([email protected])
http://secunia.com/advisories/23299 ([email protected])
http://secunia.com/advisories/23303 ([email protected])
http://secunia.com/advisories/23329 ([email protected])
http://secunia.com/advisories/23335 ([email protected])
http://secunia.com/advisories/23513 ([email protected])
http://secunia.com/advisories/24047 ([email protected])
http://security.gentoo.org/glsa/glsa-200612-03.xml ([email protected])
http://securitytracker.com/id?1017349 ([email protected])
http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm ([email protected])
http://www.debian.org/security/2006/dsa-1231 ([email protected])
http://www.kb.cert.org/vuls/id/427009 US Government Resource ([email protected])
http://www.mandriva.com/security/advisories?name=MDKSA-2006:228 ([email protected])
http://www.novell.com/linux/security/advisories/2006_28_sr.html ([email protected])
http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html ([email protected])
http://www.redhat.com/support/errata/RHSA-2006-0754.html Vendor Advisory ([email protected])
http://www.securityfocus.com/archive/1/453664/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/453723/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/21462 Vendor Advisory ([email protected])
http://www.trustix.org/errata/2006/0070 ([email protected])
http://www.ubuntu.com/usn/usn-393-1 Patch ([email protected])
http://www.ubuntu.com/usn/usn-393-2 ([email protected])
http://www.vupen.com/english/advisories/2006/4881 ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/30711 ([email protected])
https://issues.rpath.com/browse/RPL-835 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11245 ([email protected])
ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc (af854a3a-2127-422b-91ae-364da2661108)
http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23245 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23250 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23255 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23259 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23269 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23284 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23290 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23299 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23303 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23329 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23335 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/23513 (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24047 (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-200612-03.xml (af854a3a-2127-422b-91ae-364da2661108)
http://securitytracker.com/id?1017349 (af854a3a-2127-422b-91ae-364da2661108)
http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2006/dsa-1231 (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/427009 US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDKSA-2006:228 (af854a3a-2127-422b-91ae-364da2661108)
http://www.novell.com/linux/security/advisories/2006_28_sr.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2006-0754.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/453664/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/453723/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/21462 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.trustix.org/errata/2006/0070 (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/usn-393-1 Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/usn-393-2 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2006/4881 (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/30711 (af854a3a-2127-422b-91ae-364da2661108)
https://issues.rpath.com/browse/RPL-835 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11245 (af854a3a-2127-422b-91ae-364da2661108)