Re: Many vulnerabilities in GnuPG

[Solar Designer <solar () openwall com>]

On Sun, Dec 28, 2025 at 05:27:44AM +0100, Solar Designer wrote:
> >     1. Multiple Plaintext Attack on Detached PGP Signatures in GnuPG
> >     2. GnuPG Accepts Path Separators and Path Traversals in Literal Data
> >        "Filename" Field
> >     3. Cleartext Signature Plaintext Truncated for Hash Calculation
> >     4. Encrypted message malleability checks are incorrectly enforced causing
> >        plaintext recovery attacks
> >     5. Memory Corruption in ASCII-Armor Parsing
> >     6. Trusted comment injection (minisign)
> >     7. Cleartext Signature Forgery in the NotDashEscaped header
> >        implementation in GnuPG
> >     8. OpenPGP Cleartext Signature Framework Susceptible to Format Confusion
> >     9. GnuPG Output Fails To Distinguish Signature Verification Success From
> >        Message Content
> >    10. Cleartext Signature Forgery in GnuPG
> >    11. Radix64 Line-Truncation Enabling Polyglot Attacks
> >    12. GnuPG may downgrade digest algorithm to SHA1 during key signature
> >        checking
> >    13. GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys
> >    14. Trusted comment Injection (minisign)
>
> Each of the above 14 vulnerabilities has its own web page.  I attach 14
> text (converted with ELinks at width 80) and 14 HTML files corresponding
> to them.

Oh, the HTMLs got stripped by the MIME type filter.  Let me try again
with the filter temporarily disabled.  I am actually unsure we should
have them in here (not just the text versions), but since I announced...

Alexander