CVE-2006-0049
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows...
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
Exploit likelihood
What each source reports
NVD Score used
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
- Record
CVE-2006-0049- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
- Record
CVE-2006-0049- Updated
- 2026-11-02
EUVDEUVD-2006-0057 No score
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
- Record
EUVD-2006-0057- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c5p7-4hq8-gm4c No score
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows...
gpg in GnuPG before 1.4.2.2 does not properly verify non-detached signatures, which allows attackers to inject unsigned data via a data packet that is not associated with a control packet, which causes the check for concatenated signatures to report that the signature is valid, a different vulnerability than CVE-2006-0455.
- Record
GHSA-c5p7-4hq8-gm4c- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnupgDebian:3.0 |
before 1.0.6-4woody5, plus listed versions 1.0.6-4woody31.0.6-4woody4 |
1.0.6-4woody5 |
gnupgDebian:3.1 |
before 1.4.1-1.sarge3, plus listed versions 1.4.1-11.4.1-1.sarge21.4.1-1sarge1 |
1.4.1-1.sarge3 |
gnupgRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.2.1-15 | 0:1.2.1-15 |
gnupg-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.2.1-15 | 0:1.2.1-15 |
gnupgRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.2.1-15 | 0:1.2.1-15 |
gnupg-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.2.1-15 | 0:1.2.1-15 |
gnupgRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.2.1-15 | 0:1.2.1-15 |
gnupg-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.2.1-15 | 0:1.2.1-15 |
gnupgRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.2.1-15 | 0:1.2.1-15 |
gnupg-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.2.1-15 | 0:1.2.1-15 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gnupgRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:1.2.6-3 | 0:1.2.6-3 |
gnupg-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:1.2.6-3 | 0:1.2.6-3 |
gnupgRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:1.2.6-3 | 0:1.2.6-3 |
gnupg-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:1.2.6-3 | 0:1.2.6-3 |
gnupgRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:1.2.6-3 | 0:1.2.6-3 |
gnupg-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:1.2.6-3 | 0:1.2.6-3 |
gnupgRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:1.2.6-3 | 0:1.2.6-3 |
gnupg-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:1.2.6-3 | 0:1.2.6-3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-0049 is a medium vulnerability (CVSS 5.0) in Gnu Privacy Guard, published March 10, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.43%, the 84th percentile. Fixed in gnupg 1.0.6-4woody5.
References
usn.ubuntu.com/264-1
secunia.com/advisories/19249
vupen.com/english/advisories/2006/0915
redhat.com/support/errata/RHSA-2006-0266.html
lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html
securityreason.com/securityalert/450
Show 40 moreShow less
osvdb.org/23790
slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.476477
securityfocus.com/archive/1/433931/100/0/threaded
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10063
trustix.org/errata/2006/0014
securitytracker.com/id?1015749
lists.suse.de/archive/suse-security-announce/2006-Mar/0003.html
gentoo.org/security/en/glsa/glsa-200603-08.xml
exchange.xforce.ibmcloud.com/vulnerabilities/25184
mandriva.com/security/advisories?name=MDKSA-2006:055
debian.org/security/2006/dsa-993
nvd.nist.gov/vuln/detail/CVE-2006-0049
github.com/advisories/GHSA-c5p7-4hq8-gm4c
access.redhat.com/errata/RHSA-2006:0266
bugzilla.redhat.com/show_bug.cgi?id=167392
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0266.json
cve.org/CVERecord?id=CVE-2006-0049