Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.59362
Category:Fedora Local Security Checks
Title:Fedora Core 4 FEDORA-2006-867 (gnupg)
Summary:NOSUMMARY
Description:Description:

The remote host is missing an update to gnupg
announced via advisory FEDORA-2006-867.

GnuPG (GNU Privacy Guard) is a GNU utility for encrypting data and
creating digital signatures. GnuPG has advanced key management
capabilities and is compliant with the proposed OpenPGP Internet
standard described in RFC2440. Since GnuPG doesn't use any patented
algorithm, it is not compatible with any version of PGP2 (PGP2.x uses
only IDEA for symmetric-key encryption, which is patented worldwide).

Update Information:

This update upgrades GnuPG to version 1.4.5 to correct
errors in the parsing of certain types of packets.
* Tue Aug 1 2006 Nalin Dahyabhai - 1.4.5-1
- update to 1.4.5, fixing additional size overflows in packet parsing (#200904,
CVE-2006-3746)
- temporarily disable curl support again
* Fri Jul 28 2006 Nalin Dahyabhai - 1.4.4.90-1
- update to 1.4.5rc1 to check for build problems, but mark it as 1.4.4.90
to avoid looking newer than the eventual 1.4.5
- because we call aclocal, buildrequire gettext-devel to get AM_GNU_GETTEXT
* Thu Jul 20 2006 Nalin Dahyabhai - 1.4.4-7
- add BuildPrereq on curl-devel to get curl's ipv6 support (#198375)
* Wed Jul 12 2006 Nalin Dahyabhai - 1.4.4-6
- fix a cast in gpgkeys_hkp to avoid tripping stack smashing or buffer overflow
detection (#198612)
* Wed Jul 12 2006 Jesse Keating - 1.4.4-5.1
- rebuild
* Wed Jul 5 2006 Nalin Dahyabhai - 1.4.4-5
- try again using per-platform buildprereq (jkeating)
* Wed Jul 5 2006 Nalin Dahyabhai - 1.4.4-4
- buildprereq libusb-devel, so that we get CCID support back (#197450)

Solution: Apply the appropriate updates.

This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/


This update can be installed with the 'yum' update program. Use 'yum update
package-name' at the command line. For more information, refer to 'Managing
Software with yum,' available at http://fedora.redhat.com/docs/yum/.


https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2006-867

Risk factor : Medium

CVSS Score:
5.0

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2006-3746
BugTraq ID: 19110
http://www.securityfocus.com/bid/19110
Bugtraq: 20060802 rPSA-2006-0143-1 gnupg (Google Search)
http://www.securityfocus.com/archive/1/442012/100/0/threaded
Bugtraq: 20060808 ERRATA: [ GLSA 200608-08 ] GnuPG: Integer overflow vulnerability (Google Search)
http://www.securityfocus.com/archive/1/442621/100/100/threaded
Debian Security Information: DSA-1140 (Google Search)
http://www.debian.org/security/2006/dsa-1140
Debian Security Information: DSA-1141 (Google Search)
http://www.debian.org/security/2006/dsa-1141
http://security.gentoo.org/glsa/glsa-200608-08.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2006:141
http://bugs.debian.org/cgi-bin/bugreport.cgi/gnupg.CVE-2006-3746.diff?bug=381204;msg=15;att=1
http://issues.rpath.com/browse/RPL-560
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=200502
http://lists.immunitysec.com/pipermail/dailydave/2006-July/003354.html
http://www.gossamer-threads.com/lists/gnupg/devel/37623
http://www.osvdb.org/27664
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11347
http://www.redhat.com/support/errata/RHSA-2006-0615.html
http://securitytracker.com/id?1016622
http://secunia.com/advisories/21297
http://secunia.com/advisories/21300
http://secunia.com/advisories/21306
http://secunia.com/advisories/21326
http://secunia.com/advisories/21329
http://secunia.com/advisories/21333
http://secunia.com/advisories/21346
http://secunia.com/advisories/21351
http://secunia.com/advisories/21378
http://secunia.com/advisories/21467
http://secunia.com/advisories/21522
http://secunia.com/advisories/21524
http://secunia.com/advisories/21598
SGI Security Advisory: 20060801-01-P
ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P
SuSE Security Announcement: SUSE-SR:2006:020 (Google Search)
http://www.novell.com/linux/security/advisories/2006_20_sr.html
http://lwn.net/Alerts/194228/
http://www.ubuntu.com/usn/usn-332-1
http://www.vupen.com/english/advisories/2006/3123
XForce ISS Database: gnupg-parsecomment-bo(28220)
https://exchange.xforce.ibmcloud.com/vulnerabilities/28220
CopyrightCopyright (c) 2007 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2024 E-Soft Inc. All rights reserved.