mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-29 13:31:43 -09:00
deb650f221
For release announce, see: https://lists.gnupg.org/pipermail/gnupg-announce/2026q1/000501.html gnupg2 version from 2.5.13 to 2.5.16 (inclusive) are affected by the following issue: A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack buffer overflow in gpg-agent during the PKDECRYPT--kem=CMS handling. This can easily be used for a DoS but, worse, the memory corruption can very likely also be used to mount a remote code execution attack. The bug was introduced while changing an internal API to the FIPS required KEM API. Fixes: https://dev.gnupg.org/T8044 Signed-off-by: Julien Olivain <ju.o@free.fr> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>