CVE-2006-6169

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-11-29 · updated 2026-06-16

Description

Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt.

Affected products

GnuPG: 1.4, 2.0

References

http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000241.html
http://lists.suse.com/archive/suse-security-announce/2006-Dec/0004.html
http://secunia.com/advisories/23094
http://secunia.com/advisories/23110
http://secunia.com/advisories/23146
http://secunia.com/advisories/23161
http://secunia.com/advisories/23171
http://secunia.com/advisories/23250
http://secunia.com/advisories/23269
http://secunia.com/advisories/23284
http://secunia.com/advisories/23299

Get alerted when CVE-2006-6169 or the next vulnerability affects your stack