SUSE-SU-2026:20179-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202620179-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:20179-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:20179-1
- Upstream
- Related
- Published
- 2026-01-29T16:09:32Z
- Modified
- 2026-03-23T04:52:41.451883Z
- Summary
- Security update for gpg2
- Details
-
This update for gpg2 fixes the following issues:
- CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).
- CVE-2026-24883: denial of service due to long signature packet length causing parse_signature to return success with sig->data[] set to a NULL value (bsc#1257395).
- gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field (bsc#1256389).
- References