[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <874ip7hg67.fsf@gentoo.org>
Date: Tue, 30 Dec 2025 20:24:00 +0000
From: Sam James <sam@...too.org>
To: oss-security@...ts.openwall.com
Cc: "Lexi Groves (49016)" <contact@....fail>, jcb62281@...il.com, Solar
Designer <solar@...nwall.com>
Subject: Re: Many vulnerabilities in GnuPG
Demi Marie Obenour <demiobenour@...il.com> writes:
> On 12/29/25 11:57, Lexi Groves (49016) wrote:
> [...]
>> > Item 5: Memory Corruption in ASCII-Armor Parsing
>> >
>> > This is a serious memory-safety error in GPG.
>>
>> Yes. We did not have the time to try to exploit it, but we agreed that
>> there is potential for remote code execution. We think that it is
>> irresponsible to not release the fix on the 2.4 branch, which is what
>> most users in the wild use.
>
> I totally agree. This is why I referred to this vulnerability as
> a zero-day.
>
> (snip)
It's fixed in gnupg-2.4.9 for that branch, released today.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
