UnratedFix available
gnupg2 — security advisory
A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.
- Products
- gnupg2
- Affected versions
- Not specified
- Fixed versions
- 2.0.0-5.2
- CVEs
- CVE-2006-6235
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:10 UTC · Revision 1
Source evidence
A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.
osv:DEBIAN-CVE-2006-6235
gnupg2
Fixed versions: 2.0.0-5.2
gnupg2
Fixed versions: 2.0.0-5.2
gnupg2
Fixed versions: 2.0.0-5.2
Complete source record
{
"id": "bdf1301ecf32020014785cc3e2b341834c3ff91cc22ab37ab5c4964096e9f424",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2006-6235",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2006-6235",
"summary": "A \"stack overwrite\" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.",
"evidence": "osv:DEBIAN-CVE-2006-6235",
"products": [
{
"name": {
"value": "gnupg2",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.0-5.2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "gnupg2",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.0-5.2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "gnupg2",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.0-5.2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2006-6235",
"aliases": [
"DEBIAN-CVE-2006-6235"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0-5.2"
}
]
}
],
"package": {
"name": "gnupg2",
"purl": "pkg:deb/debian/gnupg2?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-6235.json"
},
"ecosystem_specific": {
"urgency": "high"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0-5.2"
}
]
}
],
"package": {
"name": "gnupg2",
"purl": "pkg:deb/debian/gnupg2?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-6235.json"
},
"ecosystem_specific": {
"urgency": "high"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0-5.2"
}
]
}
],
"package": {
"name": "gnupg2",
"purl": "pkg:deb/debian/gnupg2?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-6235.json"
},
"ecosystem_specific": {
"urgency": "high"
}
}
],
"modified": "2026-10-22T23:47:21.447134382Z",
"provider": "osv",
"upstream": [
"CVE-2006-6235"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2006-6235"
]
},
"related_cves": [
{
"value": "CVE-2006-6235",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 410308,
"published_at": "2006-12-07T11:28:00+00:00"
}