-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  gnupg (SSA:2006-072-02)

New GnuPG packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2,
and -current to fix security issues.

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0455
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0049


Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/gnupg-1.4.2.2-i486-1.tgz:  Upgraded to gnupg-1.4.2.2.
  There have been two security related issues reported recently with GnuPG.
  From the GnuPG 1.4.2.1 and 1.4.2.2 NEWS files:
    Noteworthy changes in version 1.4.2.2 (2006-03-08)
    * Files containing several signed messages are not allowed any
      longer as there is no clean way to report the status of such
      files back to the caller.  To partly revert to the old behaviour
      the new option --allow-multisig-verification may be used.
   Noteworthy changes in version 1.4.2.1 (2006-02-14)
    * Security fix for a verification weakness in gpgv.  Some input
      could lead to gpgv exiting with 0 even if the detached signature
      file did not carry any signature.  This is not as fatal as it
      might seem because the suggestion as always been not to rely on
      th exit code but to parse the --status-fd messages.  However it
      is likely that gpgv is used in that simplified way and thus we
      do this release.  Same problem with "gpg --verify" but nobody
      should have used this for signature verification without
      checking the status codes anyway.  Thanks to the taviso from
      Gentoo for reporting this problem.
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/gnupg-1.4.2.2-i386-1.tgz

Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/gnupg-1.4.2.2-i486-1.tgz

Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/gnupg-1.4.2.2-i486-1.tgz

Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/gnupg-1.4.2.2-i486-1.tgz

Updated package for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/gnupg-1.4.2.2-i486-1.tgz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/gnupg-1.4.2.2-i486-1.tgz


MD5 signatures:
+-------------+

Slackware 9.0 package:
5c88243132340003ee8739abac9801eb  gnupg-1.4.2.2-i386-1.tgz

Slackware 9.1 package:
dcf779a5d112f8386fdc51a9faf3679d  gnupg-1.4.2.2-i486-1.tgz

Slackware 10.0 package:
3e8b825c7b971d1ed2770db7766a3fee  gnupg-1.4.2.2-i486-1.tgz

Slackware 10.1 package:
d49999c8e5ac82455540ac00c1218fab  gnupg-1.4.2.2-i486-1.tgz

Slackware 10.2 package:
28a6aa4abbdaaab4efc2421ca5f68807  gnupg-1.4.2.2-i486-1.tgz

Slackware -current package:
6b55a40a674e63e22c8fa8a28c5005e9  gnupg-1.4.2.2-i486-1.tgz


Installation instructions:
+------------------------+

Upgrade the packages as root:
# upgradepkg gnupg-1.4.2.2-i486-1.tgz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)

iD8DBQFEFjgBakRjwEAQIjMRAsqKAJ96CNx03/mQHUJsBzTdBYC+plmw/wCfdEWg
ERzK74SiIiAPBfEQR+0a3m0=
=lsxu
-----END PGP SIGNATURE-----