Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with C-escape expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gnupg | Gnupg | 1.4 (including) | 1.4 (including) |
| Gnupg | Gnupg | 2.0 (including) | 2.0 (including) |
| Red Hat Enterprise Linux 2.1 | RedHat | gnupg-0:1.0.7-20 | * |
| Red Hat Enterprise Linux 3 | RedHat | gnupg-0:1.2.1-19 | * |
| Red Hat Enterprise Linux 4 | RedHat | gnupg-0:1.2.6-8 | * |
| Gnupg | Ubuntu | dapper | * |
| Gnupg | Ubuntu | devel | * |
| Gnupg | Ubuntu | edgy | * |
| Gnupg | Ubuntu | feisty | * |
| Gnupg | Ubuntu | gutsy | * |
| Gnupg | Ubuntu | hardy | * |
| Gnupg | Ubuntu | intrepid | * |
| Gnupg | Ubuntu | jaunty | * |
| Gnupg | Ubuntu | karmic | * |
| Gnupg | Ubuntu | upstream | * |
| Gnupg2 | Ubuntu | dapper | * |
| Gnupg2 | Ubuntu | edgy | * |
| Gnupg2 | Ubuntu | feisty | * |
| Gnupg2 | Ubuntu | upstream | * |