26 results · Feed
-
Low 3.6
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted arc…
-
Low 2.9CVE-2026-57062 Public exploit
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM becau…
-
High 8.4
In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for…
-
High 7.8
In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leadi…
-
Medium 5.9
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modifie…
-
Low 2.7
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid ba…
-
Low 3.3
GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatur…
-
Unscored —
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyri…
-
Medium 5.3
A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An at…
-
Unscored —
kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwis…
-
Unscored —
The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a…
-
Unscored —
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in A…
-
Unscored —
mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which all…
-
Unscored —
GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify ke…
-
Unscored —
The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent …
-
Unscored —
The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a de…
-
Unscored —
GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all …
-
Unscored —
The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, al…
-
Unscored —
Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause…
-
Unscored —
GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary…
-
Unscored —CVE-2007-1263 Public exploit
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed an…
-
Unscored —
A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows at…
-
Unscored —
Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running int…
-
Unscored —CVE-2006-3746 Public exploit
Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentati…
-
Unscored —CVE-2006-3082 Public exploit
parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of serv…
-
Unscored —
The send_pinentry_environment function in asshelp.c in gpg2 on SUSE Linux 9.3 does not properly handle certain options,…