CVE-2006-3082
Fixed in a distro release EPSS 7%
parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option.
Products: gnupg
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | gnupg2 | 1.9.20-1.1 |
| Debian 13 | gnupg2 | 1.9.20-1.1 |
| Debian 14 | gnupg2 | 1.9.20-1.1 |
| Debian 3.1 | gnupg | 1.4.1-1.sarge4 |
| Debian 3.1 | gnupg2 | 1.9.15-6sarge1 |
| Red Hat Enterprise Linux 3 | gnupg | 0:1.2.1-16 |
| Red Hat Enterprise Linux 3 | gnupg-debuginfo | 0:1.2.1-16 |
| Red Hat Enterprise Linux 4 | gnupg | 0:1.2.6-5 |
| Red Hat Enterprise Linux 4 | gnupg-debuginfo | 0:1.2.6-5 |