-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA1

[slackware-security]  gnupg [resigned] (SSA:2006-340-01b)

Hello,

As many people have pointed out, the last advisory (SSA:2006-340-01)
was not signed with the usual Slackware Security Team key
(fingerprint 40102233).  I did some reconfiguration on the box that
does the distribution signing and it had some unintended
side-effects.  :-/  Several CHECKSUMS.md5.asc files were also signed
with the wrong key.

The affected CHECKSUMS.md5 files have been resigned and uploaded, and
this announcement has also been signed (and verified :-) using the
usual primary Slackware signing key.

Also, it was noticed that the URL given to lists.gnupg.org was either
incorrect or has changed since the advisory was issued.  This error
has also been corrected.

Sorry for any confusion.

Pat

Corrected advisory follows:

+-----------+

[slackware-security]  gnupg (SSA:2006-340-01)

New gnupg packages are available for Slackware 9.0, 9.1, 10.0, 10.1,
10.2, and 11.0 to fix security issues.

More details about the issues may be found here:
  http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6235
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6169


Here are the details from the Slackware 11.0 ChangeLog:
+--------------------------+
patches/packages/gnupg-1.4.6-i486-1_slack11.0.tgz:
  Upgraded to gnupg-1.4.6.  This release fixes a severe and exploitable
  bug in earlier versions of gnupg.  All gnupg users should update to the
  new packages as soon as possible.  For details, see the information
  concerning CVE-2006-6235 posted on lists.gnupg.org:
    http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000491.html
  The CVE entry for this issue may be found here:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6235
  This update also addresses a more minor security issue possibly
  exploitable when GnuPG is used in interactive mode.  For more information
  about that issue, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6169
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

HINT:  Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try.  This is another primary FTP site
for Slackware that can be considerably faster than downloading
from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(https://osuosl.org/) for donating additional FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://www.slackware.com/ for
additional mirror sites near you.

Updated package for Slackware 9.0:

Updated package for Slackware 9.1:

Updated package for Slackware 10.0:

Updated package for Slackware 10.1:

Updated package for Slackware 10.2:

Updated package for Slackware 11.0:


MD5 signatures:
+-------------+

Slackware 9.0 package:
bc23c2e8fd1862a3749d7ea9478654e2  gnupg-1.4.6-i386-1_slack9.0.tgz

Slackware 9.1 package:
1ec4938e51b300f332696f76ce5476b5  gnupg-1.4.6-i486-1_slack9.1.tgz

Slackware 10.0 package:
8be8d0094be837dca5274c6ef17d0856  gnupg-1.4.6-i486-1_slack10.0.tgz

Slackware 10.1 package:
bdaf8c564a758fb13faecc8f030a8f3c  gnupg-1.4.6-i486-1_slack10.1.tgz

Slackware 10.2 package:
1c9e9f1364086ccdb204d50d0ee87df2  gnupg-1.4.6-i486-1_slack10.2.tgz

Slackware 11.0 package:
8f0cd5490e5a12bddc4be418c6806fa3  gnupg-1.4.6-i486-1_slack11.0.tgz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg gnupg-1.4.6-i486-1_slack11.0.tgz


+-----+