Secunia

A vulnerability has been reported in GnuPG, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error in the detection of unsigned data. This makes it possible to inject arbitrary data into a signed message and affects the verification of non-detached signatures and signatures embedded in encrypted messages.

The vulnerability affects all versions prior to 1.4.2.2. Version 1.9.x (development branch) is not affected unless the deprecated gpg part has been enabled.

Solution
Update to version 1.4.2.2 or later.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Tavis Ormandy.

Original Advisory
http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html

Deep Links
Links available in Customer Area