rPSA-2006-0227-1 gnupg

To: security-announce@xxxxxxxxxxxxxxx, update-announce@xxxxxxxxxxxxxxx
Subject: rPSA-2006-0227-1 gnupg
From: rPath Update Announcements <announce-noreply@xxxxxxxxx>
Date: Wed, 06 Dec 2006 16:34:50 -0500
Cc: full-disclosure@xxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx, lwn@xxxxxxx
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
User-agent: nail 11.22 3/20/05

rPath Security Advisory: 2006-0227-1
Published: 2006-12-06
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
    Indirect Deterministic Privilege Escalation
Updated Versions:
    gnupg=/conary.rpath.com@rpl:devel//1/1.4.6-0.1-

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6235
    https://issues.rpath.com/browse/RPL-835

Description:
    Previous versions of the gnupg package will execute attacker-provided
    code found in intentionally malformed OpenPGP packets. This allows an
    attacker to run arbitrary code as the user invoking gpg on the file
    that contains the malformed packets.

Prev by Date: [ MDKSA-2006:225 ] - Updated ruby packages fix DoS vulnerability
Next by Date: Microsoft 0-day word vulnerability - Secunia - Extremely critical
Previous by thread: [ MDKSA-2006:225 ] - Updated ruby packages fix DoS vulnerability
Next by thread: Microsoft 0-day word vulnerability - Secunia - Extremely critical
Index(es):
- Date
- Thread