rpm package
suse/gpg2&distro=SUSE Linux Enterprise Micro 5.2
pkg:rpm/suse/gpg2&distro=SUSE%20Linux%20Enterprise%20Micro%205.2
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-68973 | — | < 2.2.27-150300.3.16.1 | 2.2.27-150300.3.16.1 | Dec 28, 2025 | In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.) | ||
| CVE-2025-30258 | — | < 2.2.27-150300.3.13.1 | 2.2.27-150300.3.13.1 | Mar 19, 2025 | In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS." | ||
| CVE-2022-34903 | — | < 2.2.27-150300.3.5.1 | 2.2.27-150300.3.5.1 | Jul 1, 2022 | GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line. |
- CVE-2025-68973Dec 28, 2025affected < 2.2.27-150300.3.16.1fixed 2.2.27-150300.3.16.1
In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)
- CVE-2025-30258Mar 19, 2025affected < 2.2.27-150300.3.13.1fixed 2.2.27-150300.3.13.1
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
- CVE-2022-34903Jul 1, 2022affected < 2.2.27-150300.3.5.1fixed 2.2.27-150300.3.5.1
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.