Use of Incorrectly-Resolved Name or Reference

Affecting gnupg package, versions <1.4.18-7+deb8u5

Overview

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "--status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes.

References

• CONFIRM
• CVE Details
• Debian Security Advisory
• Debian Security Advisory
• Debian Security Advisory
• Debian Security Tracker
• MISC
• MISC
• MISC
• MISC
• MISC
• OSS security Advisory
• OSS security Advisory
• RHSA Security Advisory
• RHSA Security Advisory
• Seclists Full Disclosure
• Security Focus
• Security Tracker
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory
• Ubuntu Security Advisory
• Ubuntu Security Advisory