CVE-2006-6169: Buffer Overflow
Published Nov 29, 2006
·Updated
Heap-based buffer overflow in the askoutfilename function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the makeprintablestring function to return a longer string than expected while constructing a prompt.
Affected Software
2 affected components
gnupg GnuPG=1.4
gnupg GnuPG=2.0
Remediation
Patch Available
Event History
Nov 29, 2006
CVE Published
06:28 PM
Data Sourced
via NVD·06:28 PM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-6169?
CVE-2006-6169 is classified as a high severity vulnerability due to its potential to allow remote code execution.
2
How do I fix CVE-2006-6169?
To mitigate CVE-2006-6169, update GnuPG to version 2.1 or later, where the vulnerability has been addressed.
3
Which versions of GnuPG are affected by CVE-2006-6169?
CVE-2006-6169 affects GnuPG versions 1.4 and 2.0.
4
What type of vulnerability is CVE-2006-6169?
CVE-2006-6169 is a heap-based buffer overflow vulnerability.
5
Can CVE-2006-6169 be exploited remotely?
Yes, CVE-2006-6169 can be exploited remotely through specially crafted messages.