CVE - CVE-2006-6169

CVE-ID
CVE-2006-6169	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:21306 URL:http://www.securityfocus.com/bid/21306 BUGTRAQ:20061127 GnuPG 1.4 and 2.0 buffer overflow URL:http://www.securityfocus.com/archive/1/452829/100/0/threaded BUGTRAQ:20061201 rPSA-2006-0224-1 gnupg URL:http://www.securityfocus.com/archive/1/453253/100/100/threaded CONFIRM:http://support.avaya.com/elmodocs2/security/ASA-2007-047.htm CONFIRM:https://issues.rpath.com/browse/RPL-826 DEBIAN:DSA-1231 URL:http://www.debian.org/security/2006/dsa-1231 GENTOO:GLSA-200612-03 URL:http://security.gentoo.org/glsa/glsa-200612-03.xml MANDRIVA:MDKSA-2006:221 URL:~~http://www.mandriva.com/security/advisories?name=MDKSA-2006:221~~ (Obsolete source) MISC:https://bugs.g10code.com/gnupg/issue728 MLIST:[gnupg-announce] 20061127 GnuPG 1.4 and 2.0 buffer overflow URL:http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html OPENPKG:OpenPKG-SA-2006.037 URL:http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.037.html OVAL:oval:org.mitre.oval:def:11228 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11228 REDHAT:RHSA-2006:0754 URL:http://www.redhat.com/support/errata/RHSA-2006-0754.html SECTRACK:1017291 URL:http://securitytracker.com/id?1017291 SECUNIA:23094 URL:http://secunia.com/advisories/23094 SECUNIA:23110 URL:http://secunia.com/advisories/23110 SECUNIA:23146 URL:http://secunia.com/advisories/23146 SECUNIA:23161 URL:http://secunia.com/advisories/23161 SECUNIA:23171 URL:http://secunia.com/advisories/23171 SECUNIA:23250 URL:http://secunia.com/advisories/23250 SECUNIA:23269 URL:http://secunia.com/advisories/23269 SECUNIA:23284 URL:http://secunia.com/advisories/23284 SECUNIA:23299 URL:http://secunia.com/advisories/23299 SECUNIA:23303 URL:http://secunia.com/advisories/23303 SECUNIA:23513 URL:http://secunia.com/advisories/23513 SECUNIA:24047 URL:http://secunia.com/advisories/24047 SGI:20061201-01-P URL:ftp://patches.sgi.com/support/free/security/advisories/20061201-01-P.asc SREASON:1927 URL:http://securityreason.com/securityalert/1927 SUSE:SUSE-SA:2006:075 URL:http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html TRUSTIX:2006-0068 URL:~~http://www.trustix.org/errata/2006/0068/~~ (Obsolete source - check if archived by the Wayback Machine) UBUNTU:USN-389-1 URL:http://www.ubuntu.com/usn/usn-389-1 UBUNTU:USN-393-2 URL:http://www.ubuntu.com/usn/usn-393-2 VUPEN:ADV-2006-4736 URL:~~http://www.vupen.com/english/advisories/2006/4736~~ (Obsolete source) XF:gnupg-openfile-bo(30550) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/30550
Assigning CNA
MITRE Corporation
Date Record Created
20061129	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20061129)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)