CVEvulnerability

CVE-2006-6235

10.0 HIGH Published 2006-12-07 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2006-12-07
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.

Affected configurations

• gnu privacy guard 1.2.4 • gnu privacy guard 1.2.5 • gnu privacy guard 1.2.6 • gnu privacy guard 1.2.7 • gnu privacy guard 1.3.3 • gnu privacy guard 1.3.4 • gnu privacy guard 1.4 • gnu privacy guard 1.4.1 • gnu privacy guard 1.4.2 • gnu privacy guard 1.4.2.1 • gnu privacy guard 1.4.2.2 • gnu privacy guard 1.4.3 • gnu privacy guard 1.4.4 • gnu privacy guard 1.4.5 • gnu privacy guard 1.9.10 • gnu privacy guard 1.9.15 • gnu privacy guard 1.9.20 • gnu privacy guard 2.0 • gnu privacy guard 2.0.1 • gpg4win gpg4win 1.0.7 • redhat enterprise linux 4.0 • redhat enterprise linux desktop 3.0 • redhat enterprise linux desktop 4.0 • redhat fedora core core 5.0 • redhat fedora core core6 • redhat linux advanced workstation 2.1 • rpath linux 1 • slackware slackware linux 11.0 • ubuntu ubuntu linux 5.10 • ubuntu ubuntu linux 6.06

References

ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc patches.sgi.com
http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html lists.gnupg.org
http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html lists.suse.com
http://secunia.com/advisories/23245 Patch, Vendor Advisory
http://secunia.com/advisories/23250 Patch, Vendor Advisory
http://secunia.com/advisories/23255 Patch, Vendor Advisory
http://secunia.com/advisories/23259 secunia.com
http://secunia.com/advisories/23269 Patch, Vendor Advisory
http://secunia.com/advisories/23284 secunia.com
http://secunia.com/advisories/23290 secunia.com
http://secunia.com/advisories/23299 secunia.com
http://secunia.com/advisories/23303 secunia.com
http://secunia.com/advisories/23329 secunia.com
http://secunia.com/advisories/23335 secunia.com
http://secunia.com/advisories/23513 secunia.com
http://secunia.com/advisories/24047 secunia.com
http://security.gentoo.org/glsa/glsa-200612-03.xml security.gentoo.org
http://securitytracker.com/id?1017349 securitytracker.com
http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm support.avaya.com
http://www.debian.org/security/2006/dsa-1231 www.debian.org
http://www.kb.cert.org/vuls/id/427009 US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2006:228 www.mandriva.com
http://www.novell.com/linux/security/advisories/2006_28_sr.html www.novell.com
http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html www.openpkg.com
http://www.redhat.com/support/errata/RHSA-2006-0754.html Vendor Advisory
http://www.securityfocus.com/archive/1/453664/100/0/threaded www.securityfocus.com
http://www.securityfocus.com/archive/1/453723/100/0/threaded www.securityfocus.com
http://www.securityfocus.com/bid/21462 Vendor Advisory
http://www.trustix.org/errata/2006/0070 www.trustix.org
http://www.ubuntu.com/usn/usn-393-1 Patch
http://www.ubuntu.com/usn/usn-393-2 www.ubuntu.com
http://www.vupen.com/english/advisories/2006/4881 www.vupen.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/30711 exchange.xforce.ibmcloud.com
https://issues.rpath.com/browse/RPL-835 issues.rpath.com
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11245 oval.cisecurity.org
ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc patches.sgi.com
http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html lists.gnupg.org
http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html lists.suse.com
http://secunia.com/advisories/23245 Patch, Vendor Advisory
http://secunia.com/advisories/23250 Patch, Vendor Advisory
http://secunia.com/advisories/23255 Patch, Vendor Advisory
http://secunia.com/advisories/23259 secunia.com
http://secunia.com/advisories/23269 Patch, Vendor Advisory
http://secunia.com/advisories/23284 secunia.com
http://secunia.com/advisories/23290 secunia.com
http://secunia.com/advisories/23299 secunia.com
http://secunia.com/advisories/23303 secunia.com
http://secunia.com/advisories/23329 secunia.com
http://secunia.com/advisories/23335 secunia.com
http://secunia.com/advisories/23513 secunia.com
http://secunia.com/advisories/24047 secunia.com
http://security.gentoo.org/glsa/glsa-200612-03.xml security.gentoo.org
http://securitytracker.com/id?1017349 securitytracker.com
http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm support.avaya.com
http://www.debian.org/security/2006/dsa-1231 www.debian.org
http://www.kb.cert.org/vuls/id/427009 US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2006:228 www.mandriva.com
http://www.novell.com/linux/security/advisories/2006_28_sr.html www.novell.com
http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html www.openpkg.com
http://www.redhat.com/support/errata/RHSA-2006-0754.html Vendor Advisory
http://www.securityfocus.com/archive/1/453664/100/0/threaded www.securityfocus.com
http://www.securityfocus.com/archive/1/453723/100/0/threaded www.securityfocus.com
http://www.securityfocus.com/bid/21462 Vendor Advisory
http://www.trustix.org/errata/2006/0070 www.trustix.org
http://www.ubuntu.com/usn/usn-393-1 Patch
http://www.ubuntu.com/usn/usn-393-2 www.ubuntu.com
http://www.vupen.com/english/advisories/2006/4881 www.vupen.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/30711 exchange.xforce.ibmcloud.com
https://issues.rpath.com/browse/RPL-835 issues.rpath.com
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11245 oval.cisecurity.org