CVE-2006-6169
Fixed in a distro release EPSS 3%
Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt.
Products: gnupg
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | gnupg2 | 2.0.0-5.1 |
| Debian 13 | gnupg2 | 2.0.0-5.1 |
| Debian 14 | gnupg2 | 2.0.0-5.1 |
| Debian 3.1 | gnupg | 1.4.1-1.sarge6 |
| Red Hat Enterprise Linux 2.1 | gnupg | 0:1.0.7-20 |
| Red Hat Enterprise Linux 3 | gnupg | 0:1.2.1-19 |
| Red Hat Enterprise Linux 3 | gnupg-debuginfo | 0:1.2.1-19 |
| Red Hat Enterprise Linux 4 | gnupg | 0:1.2.6-8 |
| Red Hat Enterprise Linux 4 | gnupg-debuginfo | 0:1.2.6-8 |
| openSUSE Tumbleweed | gpg2 | 2.2.27-2.4 |