Updated GnuPG packages that fix two security issues are now available.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
GnuPG is a utility for encrypting data and creating digital signatures.
Tavis Ormandy discovered a stack overwrite flaw in the way GnuPG decrypts
messages. An attacker could create carefully crafted message that could cause
GnuPG to execute arbitrary code if a victim attempts to decrypt the message.
A heap based buffer overflow flaw was found in the way GnuPG constructs
messages to be written to the terminal during an interactive session. An
attacker could create a carefully crafted message which with user interaction
could cause GnuPG to execute arbitrary code with the permissions of the
user running GnuPG. (CVE-2006-6169)
All users of GnuPG are advised to upgrade to this updated package, which
contains a backported patch to correct these issues.