CVE-2006-0049
Fixed in a distro release EPSS 2%
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
Products: gnu privacy_guard
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 3.0 | gnupg | 1.0.6-4woody5 |
| Debian 3.1 | gnupg | 1.4.1-1.sarge3 |
| Red Hat Enterprise Linux 3 | gnupg | 0:1.2.1-15 |
| Red Hat Enterprise Linux 3 | gnupg-debuginfo | 0:1.2.1-15 |
| Red Hat Enterprise Linux 4 | gnupg | 0:1.2.6-3 |
| Red Hat Enterprise Linux 4 | gnupg-debuginfo | 0:1.2.6-3 |