On 2026-10-06 Salvatore Bonaccorso <[email protected]> wrote: > Source: gnupg2 > Version: 2.4.9-7 > X-Debbugs-CC: [email protected] > Severity: important > Tags: security upstream
> Hi, > The following vulnerability was published for gnupg2. > CVE-2026-105712[0]: > | gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted > | data in an archive. When extracting an untrusted archive with > | --directory (aka -C) into an existing directory containing a pre- > | existing symlink, gpgtar can follow that symlink and create or > | overwrite a file outside the selected extraction directory. The > | write is limited by the extraction user's filesystem permissions. An > | archive extracted into a fresh empty directory does not have this > | risk. > If you fix the vulnerability please also make sure to include the > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. [...] Good morning, I suspect this is not worth a DSA? cu Andreas -- "You people are noisy," Nia said. I made the gesture of agreement.
