Bug 218821

Summary:	CVE-2006-6235: gnupg2 <= 2.0.1 stack overwrite vulnerability
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <ville.skytta>
Component:	gnupg2	Assignee:	Rex Dieter <rdieter>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5	CC:	extras-qa, fedora-security-list
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	2.0.1-2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-12-07 18:25:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2006-12-07 18:16:46 UTC

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-6235

"A "stack overwrite" vulnerability in GnuPG (gpg) before 1.2.1 allows attackers
to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to
dereference a function pointer from deallocated stack memory."

FC6+ seem to be taken care of already, FC-[345] not yet.

Comment 1 Rex Dieter 2006-12-07 18:25:37 UTC

Right FC-6+ build pushed yesterday already.

%changelog
* Wed Dec 06 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.1-2
- CVE-2006-6235 (bug #218821)

Older releases don't include the gpg2 (and friends) binaries, so they aren't
(shouldn't!) be affected by this.

Comment 2 Ville Skyttä 2006-12-07 20:04:28 UTC

Seems so indeed.