Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Loading...
Explore Latest Linux Security advisories
We found 86 articles for you...
89
security advisoryfedoraupdateFedora 44 rust-sequoia-chameleon-gnupg Low Severity Update 2026-5c5f4f40a4
Update the sequoia-wot crate to version 0.15.2. Update the sequoia-keystore crate to version 0.7.3. This includes a rebuild of all dependent applications to address three low- severity security vulnerabilities in sequoia-wot: https://gitlab.com/sequoia-pgp/sequoia-wot/-/commit/77605b2f. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-5c5f4f40a4 2026-06-05 04:25:00.359000+00:00 -------------------------------------------------------------------------------- Name : rust-sequoia-chameleon-gnupg Product : Fedora 44 Version : 0.13.1 Release : 13.fc44 URL : https://crates.io/crates/sequoia-chameleon-gnupg Summary : Sequoia's reimplementation of the GnuPG interface Description : Sequoia's reimplementation of the GnuPG interface. -------------------------------------------------------------------------------- Update Information: Update the sequoia-wot crate to version 0.15.2. Update the sequoia-keystore crate to version 0.7.3. This includes a rebuild of all dependent applications to address three low- severity security vulnerabilities in sequoia-wot: https://gitlab.com/sequoia-pgp/sequoia-wot/-/commit/77605b2f https://gitlab.com/sequoia-pgp/sequoia-wot/-/commit/81210321 https://gitlab.com/sequoia-pgp/sequoia-wot/-/commit/dd2ffb50 -------------------------------------------------------------------------------- ChangeLog: * Wed May 27 2026 Fabio Valentini - 0.13.1-13 - Bump sequoia-wot dependency from 0.14 to 0.15 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2356514 - Package NEWS https://bugzilla.redhat.com/show_bug.cgi?id=2356514 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-5c5f4f40a4' at the command line. For more information, refer to the dnf documentationavailable at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 05, 2026
•Low
Fedora
172
security advisorygnupgcriticalUbuntu 25.10: GnuPG Critical Remote Code Exec Vulnerability USN-7946-1
GnuPG could be made to crash or run programs if it received specially crafted network traffic.. ========================================================================== Ubuntu Security Notice USN-7946-1 January 08, 2026 gnupg2 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 25.04 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: GnuPG could be made to crash or run programs if it received specially crafted network traffic. Software Description: - gnupg2: GNU privacy guard - a free PGP replacement Details: It was discovered that GnuPG incorrectly handled crafted input. A remote attacker could possibly use this issue to crash the program, or execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 gnupg 2.4.8-2ubuntu2.1 gnupg2 2.4.8-2ubuntu2.1 gpg 2.4.8-2ubuntu2.1 Ubuntu 25.04 gnupg 2.4.4-2ubuntu23.2 gnupg2 2.4.4-2ubuntu23.2 gpg 2.4.4-2ubuntu23.2 Ubuntu 24.04 LTS gnupg 2.4.4-2ubuntu17.4 gnupg2 2.4.4-2ubuntu17.4 gpg 2.4.4-2ubuntu17.4 Ubuntu 22.04 LTS gnupg 2.2.27-3ubuntu2.5 gnupg2 2.2.27-3ubuntu2.5 gpg 2.2.27-3ubuntu2.5 Ubuntu 20.04 LTS gnupg 2.2.19-3ubuntu2.5+esm1 Available with Ubuntu Pro gnupg2 2.2.19-3ubuntu2.5+esm1 Available with Ubuntu Pro gpg 2.2.19-3ubuntu2.5+esm1 Available with Ubuntu Pro Ubuntu18.04 LTS gnupg 2.2.4-1ubuntu1.6+esm2 Available with Ubuntu Pro gnupg2 2.2.4-1ubuntu1.6+esm2 Available with Ubuntu Pro gpg 2.2.4-1ubuntu1.6+esm2 Available with Ubuntu Pro Ubuntu 16.04 LTS gnupg2 2.1.11-6ubuntu2.1+esm3 Available with Ubuntu Pro gpgv2 2.1.11-6ubuntu2.1+esm3 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7946-1 CVE-2025-68973 Package Information: https://launchpad.net/ubuntu/+source/gnupg2/2.4.8-2ubuntu2.1 https://launchpad.net/ubuntu/+source/gnupg2/2.4.4-2ubuntu23.2 https://launchpad.net/ubuntu/+source/gnupg2/2.2.27-3ubuntu2.5 . A critical security notice for Ubuntu's GnuPG highlights a remote crash issue from crafted network traffic.. Ubuntu GnuPG update, security advisory Ubuntu, remote code execution, GnuPG critical issue, network traffic vulnerability. . Severity: Critical. LinuxSecurity.com Team
Jan 08, 2026
•Critical
Ubuntu
172
security advisorygnupgcriticalUbuntu 16.04 LTS: GnuPG Critical Remote Code Exec Vulnerability USN-7946-2
GnuPG could be made to crash or run programs if it received specially crafted network traffic.. ========================================================================== Ubuntu Security Notice USN-7946-2 January 08, 2026 gnupg vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: GnuPG could be made to crash or run programs if it received specially crafted network traffic. Software Description: - gnupg: GNU privacy guard - a free PGP replacement Details: USN-7946-1 fixed vulnerabilities in GnuPG 2.x. This update provides the corresponding updates for GnuPG 1.x. Original advisory details: It was discovered that GnuPG incorrectly handled crafted input. A remote attacker could possibly use this issue to crash the program, or execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS gnupg 1.4.20-1ubuntu3.3+esm3 Available with Ubuntu Pro gpgv 1.4.20-1ubuntu3.3+esm3 Available with Ubuntu Pro Ubuntu 14.04 LTS gnupg 1.4.16-1ubuntu2.6+esm2 Available with Ubuntu Pro gpgv 1.4.16-1ubuntu2.6+esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7946-2 https://ubuntu.com/security/notices/USN-7946-1 CVE-2025-68973 . GnuPG vulnerable to specially crafted traffic, causing crashes or code execution on Ubuntu 14.04 and 16.04 LTS.. Ubuntu GnuPG update, remote code execution fix, security advisory GnuPG. . Severity: Critical. LinuxSecurity.com Team
Jan 08, 2026
•Critical
Ubuntu
172
security advisorygnupgcriticalUbuntu 18.04 LTS: GnuPG Keyring Corruption Issue USN-7412-3 CVE-2025-30258
GnuPG could be made to corrupt a keyring.. ========================================================================== Ubuntu Security Notice USN-7412-3 December 09, 2025 gnupg2 vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: GnuPG could be made to corrupt a keyring. Software Description: - gnupg2: GNU privacy guard - a free PGP replacement Details: USN-7412-1 fixed a vulnerability in GnuPG. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that GnuPG incorrectly handled importing keys with certain crafted subkey data. If a user or automated system were tricked into importing a specially crafted key, a remote attacker may prevent users from importing other keys in the future. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS gnupg 2.2.4-1ubuntu1.6+esm1 Available with Ubuntu Pro gnupg2 2.2.4-1ubuntu1.6+esm1 Available with Ubuntu Pro gpg 2.2.4-1ubuntu1.6+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS gnupg2 2.1.11-6ubuntu2.1+esm2 Available with Ubuntu Pro gpgv2 2.1.11-6ubuntu2.1+esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7412-3 https://ubuntu.com/security/notices/USN-7412-2 https://ubuntu.com/security/notices/USN-7412-1 CVE-2025-30258 . GnuPG update for Ubuntu resolves critical keyring corruption issue through security advisory USN-7412-3.. GnuPG Update,Ubuntu Security, Keyring Corruption, Remote Access. . Severity: Critical. LinuxSecurity.com Team
Dec 09, 2025
•Critical
Ubuntu
172
security advisorygnupgUbuntuUbuntu 22.04 LTS USN-7412-2 important: gnupg regression issue
USN-7412-1 introduced a regression in GnuPG.. ========================================================================== Ubuntu Security Notice USN-7412-2 July 08, 2025 gnupg2 regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.04 - Ubuntu 24.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: USN-7412-1 introduced a regression in GnuPG. Software Description: - gnupg2: GNU privacy guard - a free PGP replacement Details: USN-7412-1 fixed vulnerabilities in GnuPG. The update introduced a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that GnuPG incorrectly handled importing keys with certain crafted subkey data. If a user or automated system were tricked into importing a specially crafted key, a remote attacker may prevent users from importing other keys in the future. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.04 gnupg 2.4.4-2ubuntu23.1 gnupg2 2.4.4-2ubuntu23.1 gpg 2.4.4-2ubuntu23.1 Ubuntu 24.10 gnupg 2.4.4-2ubuntu18.3 gnupg2 2.4.4-2ubuntu18.3 gpg 2.4.4-2ubuntu18.3 Ubuntu 24.04 LTS gnupg 2.4.4-2ubuntu17.3 gnupg2 2.4.4-2ubuntu17.3 gpg 2.4.4-2ubuntu17.3 Ubuntu 22.04 LTS gnupg 2.2.27-3ubuntu2.4 gnupg2 2.2.27-3ubuntu2.4 gpg 2.2.27-3ubuntu2.4 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7412-2 https://ubuntu.com/security/notices/USN-7412-1 https://bugs.launchpad.net/ubuntu/+source/gnupg2/+bug/2114775 Package Information: https://launchpad.net/ubuntu/+source/gnupg2/2.4.4-2ubuntu23.1 https://launchpad.net/ubuntu/+source/gnupg2/2.4.4-2ubuntu18.3 https://launchpad.net/ubuntu/+source/gnupg2/2.4.4-2ubuntu17.3 https://launchpad.net/ubuntu/+source/gnupg2/2.2.27-3ubuntu2.4 . Recent vulnerability discovered in GnuPG across various Ubuntu versions, posing a risk to system security. Apply the latest patches to resolve complications caused by earlier updates.. gnupg security update, ubuntu system fix, GPG security risk. . Severity: Important. LinuxSecurity.com Team
Jul 09, 2025
•Important
Ubuntu
91
security advisorygentoognupgGentoo GLSA-202408-23 Normal: GnuPG Signature Spoofing Advisory
Multiple vulnerabilities have been discovered in GnuPG, the worst of which could lead to signature spoofing.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202408-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: GnuPG: Multiple Vulnerabilities Date: August 10, 2024 Bugs: #855395, #923248 ID: 202408-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in GnuPG, the worst of which could lead to signature spoofing. Background ========== The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of cryptographic software. Affected packages ================= Package Vulnerable Unaffected --------------- ------------ ------------ app-crypt/gnupg < 2.4.4 > = 2.4.4 Description =========== Multiple vulnerabilities have been discovered in GnuPG. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All GnuPG users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-crypt/gnupg-2.4.4" References ========== [ 1 ] CVE-2022-34903 https://nvd.nist.gov/vuln/detail/CVE-2022-34903 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202408-23 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Aug 10, 2024
Gentoo
89
security advisorygnupgcriticalFedora 36: 2022-1747eea46c Critical: GnuPG Signature Spoofing
Security fix for CVE-2022-34903. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-1747eea46c 2022-07-28 01:26:41.098904 --------------------------------------------------------------------------------Name : gnupg1 Product : Fedora 36 Version : 1.4.23 Release : 18.fc36 URL : http://www.gnupg.org/ Summary : A GNU utility for secure communication and data storage Description : GnuPG (GNU Privacy Guard) is a GNU utility for encrypting data and creating digital signatures. GnuPG has advanced key management capabilities and is compliant with the proposed OpenPGP Internet standard described in RFC2440. Since GnuPG doesn't use any patented algorithm, it is not compatible with any version of PGP2 (PGP2.x uses only IDEA for symmetric-key encryption, which is patented worldwide). --------------------------------------------------------------------------------Update Information: Security fix for CVE-2022-34903 --------------------------------------------------------------------------------ChangeLog: * Tue Jul 19 2022 Brian C. Lane - 1.4.23-18 - g10/status.c: Backport fix for status buffer overrun Resolves: rhbz#2108445 - Note that this includes the fix for [CVE-2022-34903] --------------------------------------------------------------------------------References: [ 1 ] Bug #2102868 - CVE-2022-34903 gpg: Signature spoofing via status line injection https://bugzilla.redhat.com/show_bug.cgi?id=2102868 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-1747eea46c' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jul 27, 2022
•Critical
Fedora
172
security advisorygnupgcriticalUbuntu 22.04 LTS: USN-5503-1 Critical GnuPG Forged Signature Threat
GnuPG could allow forged signatures.. =========================================================================Ubuntu Security Notice USN-5503-1 July 05, 2022 gnupg2 vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 21.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: GnuPG could allow forged signatures. Software Description: - gnupg2: GNU privacy guard - a free PGP replacement Details: Demi Marie Obenour discovered that GnuPG incorrectly handled injection in the status message. A remote attacker could possibly use this issue to forge signatures. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: gnupg 2.2.27-3ubuntu2.1 gnupg2 2.2.27-3ubuntu2.1 gpg 2.2.27-3ubuntu2.1 Ubuntu 21.10: gnupg 2.2.20-1ubuntu4.1 gnupg2 2.2.20-1ubuntu4.1 gpg 2.2.20-1ubuntu4.1 Ubuntu 20.04 LTS: gnupg 2.2.19-3ubuntu2.2 gnupg2 2.2.19-3ubuntu2.2 gpg 2.2.19-3ubuntu2.2 Ubuntu 18.04 LTS: gnupg 2.2.4-1ubuntu1.6 gnupg2 2.2.4-1ubuntu1.6 gpg 2.2.4-1ubuntu1.6 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5503-1 CVE-2022-34903 Package Information: https://launchpad.net/ubuntu/+source/gnupg2/2.2.27-3ubuntu2.1 https://launchpad.net/ubuntu/+source/gnupg2/2.2.20-1ubuntu4.1 https://launchpad.net/ubuntu/+source/gnupg2/2.2.19-3ubuntu2.2 https://launchpad.net/ubuntu/+source/gnupg2/2.2.4-1ubuntu1.6 . Critical GnuPG flaw permits counterfeitsignatures across various Ubuntu iterations. Protect your system by performing an immediate update!. Ubuntu Security Update,GPG vulnerability,GnuPG patch,forged signatures. . Severity: Critical. LinuxSecurity.com Team
Jul 05, 2022
•Critical
Ubuntu
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Is continuous patching actually viable?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!