Description
A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gnupg2 | 2.0.0-5.2 | — |
| Debian 13 | gnupg2 | 2.0.0-5.2 | — |
| Debian 12 | gnupg2 | 2.0.0-5.2 | — |
| Debian 3.1 | gnupg | 1.4.1-1.sarge6 | DSA-1231-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | gnupg | 1.2.6-8 | RHSA-2006:0754 |
| RHEL 3 | gnupg | 1.2.1-19 | RHSA-2006:0754 |
| RHEL 2 | gnupg | 1.0.7-20 | RHSA-2006:0754 |
Advisories 2
- RHSA-2006:0754 Red Hat Security Advisory: gnupg security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1231-1 gnupg Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1017349 vdb-entry
- 23269 third-party-advisory
- 23303 third-party-advisory
- 20061206 rPSA-2006-0227-1 gnupg mailing-list
- 23255 third-party-advisory
- USN-393-1 vendor-advisory
- 23513 third-party-advisory
- 23284 third-party-advisory
- USN-393-2 vendor-advisory
- 23245 third-party-advisory
- [gnupg-announce] GnuPG: remotely controllable function pointer [CVE-2006-6235] mailing-list
- VU#427009 third-party-advisory
- SUSE-SR:2006:028 vendor-advisory
- RHSA-2006:0754 vendor-advisory
- DSA-1231 vendor-advisory
- 20061206 GnuPG: remotely controllable function pointer [CVE-2006-6235] mailing-list
- 23335 third-party-advisory
- 23299 third-party-advisory
- 21462 vdb-entry
- 2006-0070 vendor-advisory
- 23329 third-party-advisory
- GLSA-200612-03 vendor-advisory
- 23259 third-party-advisory
- MDKSA-2006:228 vendor-advisory
- 23290 third-party-advisory
- https://issues.rpath.com/browse/RPL-835
- SUSE-SA:2006:075 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm
- ADV-2006-4881 vdb-entry
- oval:org.mitre.oval:def:11245 vdb-entry signature
- 23250 third-party-advisory
- gnupg-openpgp-code-execution(30711) vdb-entry
- OpenPKG-SA-2006.037 vendor-advisory
- 24047 third-party-advisory