CVE-2006-3746
Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial...
Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.
- Record
CVE-2006-3746- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.
- Record
CVE-2006-3746- Updated
- 2026-11-02
EUVDEUVD-2006-3740 No score
Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.
- Record
EUVD-2006-3740- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qr6w-8m4j-52r2 No score
Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial...
Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.
- Record
GHSA-qr6w-8m4j-52r2- Updated
- 2026-11-02
OSVBELL-CVE-2006-3746
CVE-2006-3746 does not affect BellSoft software
- Record
BELL-CVE-2006-3746- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
OSV No score
Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.
- Record
CVE-2006-3746- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-3746 No score
Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.
- Record
DEBIAN-CVE-2006-3746- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10815-1 No score
dirmngr-2.2.27-2.4 on GA media
These are all security issues fixed in the dirmngr-2.2.27-2.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10815-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnupg2Debian:12 |
before 1.9.20-2 | 1.9.20-2 |
gnupg2Debian:13 |
before 1.9.20-2 | 1.9.20-2 |
gnupg2Debian:14 |
before 1.9.20-2 | 1.9.20-2 |
gnupgDebian:3.1 |
before 1.4.1-1.sarge5, plus listed versions 1.4.1-11.4.1-1.sarge21.4.1-1.sarge31.4.1-1.sarge41.4.1-1sarge1 |
1.4.1-1.sarge5 |
gnupg2Debian:3.1 |
before 1.9.15-6sarge2, plus listed versions 1.9.15-61.9.15-6sarge1 |
1.9.15-6sarge2 |
gnupgRed Hat:enterprise_linux:3::as |
before 0:1.2.1-17 | 0:1.2.1-17 |
gnupg-debuginfoRed Hat:enterprise_linux:3::as |
before 0:1.2.1-17 | 0:1.2.1-17 |
gnupgRed Hat:enterprise_linux:3::desktop |
before 0:1.2.1-17 | 0:1.2.1-17 |
gnupg-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:1.2.1-17 | 0:1.2.1-17 |
gnupgRed Hat:enterprise_linux:3::es |
before 0:1.2.1-17 | 0:1.2.1-17 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gnupg-debuginfoRed Hat:enterprise_linux:3::es |
before 0:1.2.1-17 | 0:1.2.1-17 |
gnupgRed Hat:enterprise_linux:3::ws |
before 0:1.2.1-17 | 0:1.2.1-17 |
gnupg-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:1.2.1-17 | 0:1.2.1-17 |
gnupgRed Hat:enterprise_linux:4::as |
before 0:1.2.6-6 | 0:1.2.6-6 |
gnupg-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.2.6-6 | 0:1.2.6-6 |
gnupgRed Hat:enterprise_linux:4::desktop |
before 0:1.2.6-6 | 0:1.2.6-6 |
gnupg-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.2.6-6 | 0:1.2.6-6 |
gnupgRed Hat:enterprise_linux:4::es |
before 0:1.2.6-6 | 0:1.2.6-6 |
gnupg-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.2.6-6 | 0:1.2.6-6 |
gnupgRed Hat:enterprise_linux:4::ws |
before 0:1.2.6-6 | 0:1.2.6-6 |
gnupg-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.2.6-6 | 0:1.2.6-6 |
gpg2openSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 2.2.27-2.4 | 2.2.27-2.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | GnuPG 1.4/1.9 - Parse_Comment Remote Buffer Overflow | 2006-07-22 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3746 is a medium vulnerability (CVSS 5.0) in Gnupg, published July 28, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.21%, the 94th percentile. Fixed in gnupg2 1.9.20-2.
References
secunia.com/advisories/21329
redhat.com/support/errata/RHSA-2006-0615.html
bugs.debian.org/cgi-bin/bugreport.cgi/gnupg.CVE-2006-3746.diff?bug=381204%3Bmsg=15%3Batt=1
vupen.com/english/advisories/2006/3123
novell.com/linux/security/advisories/2006_20_sr.html
Show 48 moreShow less
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11347
issues.rpath.com/browse/RPL-560
exchange.xforce.ibmcloud.com/vulnerabilities/28220
debian.org/security/2006/dsa-1140
securityfocus.com/bid/19110
support.avaya.com/elmodocs2/security/ASA-2006-164.htm
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=200502
gossamer-threads.com/lists/gnupg/devel/37623
mandriva.com/security/advisories?name=MDKSA-2006:141
lists.immunitysec.com/pipermail/dailydave/2006-July/003354.html
ubuntu.com/usn/usn-332-1
securitytracker.com/id?1016622
osvdb.org/27664
security.gentoo.org/glsa/glsa-200608-08.xml
lwn.net/Alerts/194228
nvd.nist.gov/vuln/detail/CVE-2006-3746
github.com/advisories/GHSA-qr6w-8m4j-52r2
docs.bell-sw.com/security/cves/CVE-2006-3746
security-tracker.debian.org/tracker/CVE-2006-3746
access.redhat.com/errata/RHSA-2006:0615
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0615.json
cve.org/CVERecord?id=CVE-2006-3746
suse.com/security/cve/CVE-2006-0455