GnuPG: Integer overflow vulnerability — GLSA 200608-08

GnuPG is vulnerable to an integer overflow that could lead to the execution of arbitrary code.

Affected packages

Background

The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of cryptographic software.

Description

Evgeny Legerov discovered a vulnerability in GnuPG that when certain packets are handled an integer overflow may occur.

Impact

By sending a specially crafted email to a user running an affected version of GnuPG, a remote attacker could possibly execute arbitrary code with the permissions of the user running GnuPG.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose "=app-crypt/gnupg-1.4*"

References

• CVE-2006-3746

Release date
August 05, 2006

Latest revision
August 08, 2006: 02

Severity
high

Exploitable
remote

Bugzilla entries

• 142248