CVE-2006-3082

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-06-19 · updated 2026-06-16
Weakness: CWE-189

Description

parse-packet.c in GnuPG (gpg) 1.4.3 and 1.9.20, and earlier versions, allows remote attackers to cause a denial of service (gpg crash) and possibly overwrite memory via a message packet with a large length (long user ID string), which could lead to an integer overflow, as demonstrated using the --no-armor option.

Affected products

GnuPG: through 1.9.20; 1.4.3

References

http://cvs.gnupg.org/cgi-bin/viewcvs.cgi/trunk/g10/parse-packet.c?rev=4157&r1=4141&r2=4157
http://seclists.org/lists/fulldisclosure/2006/May/0774.html
http://seclists.org/lists/fulldisclosure/2006/May/0782.html
http://seclists.org/lists/fulldisclosure/2006/May/0789.html
http://secunia.com/advisories/20783
http://secunia.com/advisories/20801
http://secunia.com/advisories/20811
http://secunia.com/advisories/20829
http://secunia.com/advisories/20881
http://secunia.com/advisories/20899
http://secunia.com/advisories/20968

Get alerted when CVE-2006-3082 or the next vulnerability affects your stack