Vulnerabilities > PGP
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2010-11-22 | CVE-2010-3618 | Cryptographic Issues vulnerability in PGP Desktop FOR mac and Desktop for Windows PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an additional message to the end of a legitimately signed message, related to a "piggy-back" or "unsigned data injection" issue. | 4.3 |
| 2010-09-15 | CVE-2010-3397 | DLL Loading Arbitrary Code Execution vulnerability in PGP Desktop 10.0.0/9.10.0/9.9.0 Untrusted search path vulnerability in PGP Desktop 9.9.0 Build 397, 9.10.x, 10.0.0 Build 2732, and probably other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse tsp.dll or tvttsp.dll that is located in the same folder as a .p12, .pem, .pgp, .prk, .prvkr, .pubkr, .rnd, or .skr file. | 9.3 |
| 2009-04-15 | CVE-2009-0681 | Improper Input Validation vulnerability in PGP Desktop 8.0/9.0/9.0.6 PGP Desktop before 9.10 allows local users to (1) cause a denial of service (crash) via a crafted IOCTL request to pgpdisk.sys, and (2) cause a denial of service (crash) and execute arbitrary code via a crafted IRP in an IOCTL request to pgpwded.sys. | 7.2 |
| 2008-12-26 | CVE-2008-5731 | Resource Management Errors vulnerability in PGP Desktop 9.0.6/9.9.0 The PGPwded device driver (aka PGPwded.sys) in PGP Corporation PGP Desktop 9.0.6 build 6060 and 9.9.0 build 397 allows local users to cause a denial of service (system crash) and possibly gain privileges via a certain METHOD_BUFFERED IOCTL request that overwrites portions of memory, related to a "Driver Collapse." NOTE: some of these details are obtained from third party information. | 4.9 |
| 2007-01-30 | CVE-2007-0603 | Remote Code Execution vulnerability in PGP Corporate Desktop 9.5 PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a data object representing an absolute pointer, which causes code execution at the corresponding address. | 7.1 |
| 2005-12-10 | CVE-2005-4151 | Unspecified vulnerability in PGP Desktop 8.0/9.0 The Wipe Free Space utility in PGP Desktop Home 8.0 and Desktop Professional 9.0.3 Build 2932 and earlier does not clear file slack space in the last cluster for the file, which allows local users to access the previous contents of the disk. | 2.1 |
| 2002-12-31 | CVE-2002-2069 | Incomplete Cleanup vulnerability in PGP Personal Privacy PGP 6.x and 7.x does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted. | 7.5 |
| 2002-12-31 | CVE-2002-1977 | Unspecified vulnerability in PGP 7.0.4/7.1 Network Associates PGP 7.0.4 and 7.1 does not time out according to the value set in the "Passphrase Cache" option, which could allow attackers to open encrypted files without providing a passphrase. | 2.1 |
| 2002-12-31 | CVE-2002-1696 | Cleartext Storage of Sensitive Information vulnerability in PGP Personal Privacy 7.0/7.0.3/7.0.4 Microsoft Outlook plug-in PGP version 7.0, 7.0.3, and 7.0.4 silently saves a decrypted copy of a message to hard disk when "Automatically decrypt/verify when opening messages" option is checked, "Always use Secure Viewer when decrypting" option is not checked, and the user replies to an encrypted message. | 5.5 |
| 2002-10-04 | CVE-2002-0850 | Buffer Overflow vulnerability in PGP Corporate Desktop 7.1.1 Buffer overflow in PGP Corporate Desktop 7.1.1 allows remote attackers to execute arbitrary code via an encrypted document that has a long filename when it is decrypted. | 7.5 |