Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20136-1

Опубликовано: 29 янв. 2026
Источник: suse-cvrf

Описание

Security update for gpg2

This update for gpg2 fixes the following issues:

  • CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).
  • CVE-2026-24883: denial of service due to long signature packet length causing parse_signature to return success with sig->data[] set to a NULL value (bsc#1257395).
  • gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field (bsc#1256389).

Список пакетов

openSUSE Leap 16.0
dirmngr-2.5.5-160000.4.1
gpg2-2.5.5-160000.4.1
gpg2-lang-2.5.5-160000.4.1
gpg2-tpm-2.5.5-160000.4.1

Ссылки

Описание

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Затронутые продукты
openSUSE Leap 16.0:dirmngr-2.5.5-160000.4.1
openSUSE Leap 16.0:gpg2-2.5.5-160000.4.1
openSUSE Leap 16.0:gpg2-lang-2.5.5-160000.4.1
openSUSE Leap 16.0:gpg2-tpm-2.5.5-160000.4.1
Ссылки

Описание

In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).

Затронутые продукты
openSUSE Leap 16.0:dirmngr-2.5.5-160000.4.1
openSUSE Leap 16.0:gpg2-2.5.5-160000.4.1
openSUSE Leap 16.0:gpg2-lang-2.5.5-160000.4.1
openSUSE Leap 16.0:gpg2-tpm-2.5.5-160000.4.1
Ссылки