CVE-2006-0049

Published: Mar 13, 2006Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.

Affected (24)

Products: Gnu: Privacy Guard

Gnu

1 product

Privacy Guard

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Gnu Privacy Guard	Version 1.0.1
Gnu Privacy Guard	Version 1.0.2
Gnu Privacy Guard	Version 1.0.3
Gnu Privacy Guard	Version 1.0.3b
Gnu Privacy Guard	Version 1.0.4
Gnu Privacy Guard	Version 1.0.5
Gnu Privacy Guard	Version 1.0.6
Gnu Privacy Guard	Version 1.0.7
Gnu Privacy Guard	Version 1.0
Gnu Privacy Guard	Version 1.2.1
Gnu Privacy Guard	Version 1.2.2
Gnu Privacy Guard	Version 1.2.2 rc1
Gnu Privacy Guard	Version 1.2.3
Gnu Privacy Guard	Version 1.2.4
Gnu Privacy Guard	Version 1.2.5
Gnu Privacy Guard	Version 1.2.6
Gnu Privacy Guard	Version 1.2.7
Gnu Privacy Guard	Version 1.2
Gnu Privacy Guard	Version 1.3.3
Gnu Privacy Guard	Version 1.3.4
Gnu Privacy Guard	Version 1.4.1
Gnu Privacy Guard	Version 1.4.2.1
Gnu Privacy Guard	Version 1.4.2
Gnu Privacy Guard	Version 1.4

References (62)

ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U (unsafe URL)

Source: security@debian.org

http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html

Source: security@debian.org

PatchVendor Advisory

http://lists.suse.de/archive/suse-security-announce/2006-Mar/0003.html

Source: security@debian.org

http://secunia.com/advisories/19173

Source: security@debian.org

PatchVendor Advisory

http://secunia.com/advisories/19197

Source: security@debian.org

http://secunia.com/advisories/19203

Source: security@debian.org

http://secunia.com/advisories/19231

Source: security@debian.org

http://secunia.com/advisories/19232

Source: security@debian.org

http://secunia.com/advisories/19234

Source: security@debian.org

http://secunia.com/advisories/19244

Source: security@debian.org

http://secunia.com/advisories/19249

Source: security@debian.org

http://secunia.com/advisories/19287

Source: security@debian.org

http://secunia.com/advisories/19532

Source: security@debian.org

http://securityreason.com/securityalert/450

Source: security@debian.org

http://securityreason.com/securityalert/568

Source: security@debian.org

http://securitytracker.com/id?1015749

Source: security@debian.org

Patch

http://www.debian.org/security/2006/dsa-993

Source: security@debian.org

PatchVendor Advisory

http://www.gentoo.org/security/en/glsa/glsa-200603-08.xml

Source: security@debian.org

PatchVendor Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2006:055

Source: security@debian.org

http://www.osvdb.org/23790

Source: security@debian.org

Patch

http://www.redhat.com/archives/fedora-announce-list/2006-March/msg00021.html

Source: security@debian.org

http://www.redhat.com/support/errata/RHSA-2006-0266.html

Source: security@debian.org

http://www.securityfocus.com/archive/1/427324/100/0/threaded

Source: security@debian.org

http://www.securityfocus.com/archive/1/433931/100/0/threaded

Source: security@debian.org

http://www.securityfocus.com/bid/17058

Source: security@debian.org

Patch

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.476477

Source: security@debian.org

http://www.trustix.org/errata/2006/0014

Source: security@debian.org

http://www.vupen.com/english/advisories/2006/0915

Source: security@debian.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/25184

Source: security@debian.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10063

Source: security@debian.org

https://usn.ubuntu.com/264-1/

Source: security@debian.org

ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U (unsafe URL)