Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 631
Alerts This Week
Warning Icon 1 631

openSUSE: gpg2 Important Memory Corruption Threat CVE-2025-68973

opensuse
Calendar Grey January 15, 2026
Dist Opensuse Esm H88
An important update for openSUSE fixing memory corruption issues in gpg2 and providing additional bug fixes for better security.
An update that solves one vulnerability and has 4 bug fixes can now be installed.

Description

This update for gpg2 fixes the following issues:

- CVE-2025-68973: out-of-bounds write when processing specially crafted input in the armor parser can lead to memory corruption (bsc#1255715).

Other security fixes:

- gpg: Avoid potential downgrade to SHA1 in 3rd party key signatures (bsc#1256246).

- gpg: Error out on unverified output for non-detached signatures (bsc#1256244).

- gpg: Deprecate the option --not-dash-escaped (bsc#1256390).

Patch instructions:

To install this openSUSE security update use the suse recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

zypper in -t patch openSUSE-Leap-16.0-138=1

Topics%20covered

Topics Covered

security advisory security issue memory corruption important OpenSUSE gpg2

Patch

Package List

- openSUSE Leap 16.0:

dirmngr-2.5.5-160000.3.1

gpg2-2.5.5-160000.3.1

gpg2-lang-2.5.5-160000.3.1

gpg2-tpm-2.5.5-160000.3.1

References

* bsc#1255715

* bsc#1256244

* bsc#1256246

* bsc#1256390

References:

* https://www.suse.com/security/cve/CVE-2025-68973.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2026:20029-1
Rating: important
Affected Products: openSUSE Leap 16.0 -------------------------------------------------------------

Topics%20covered

Topics Covered

security advisory security issue memory corruption important OpenSUSE gpg2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.