A critical GnuPG security update

There is a new GnuPG update for a "critical security bug" in recentGnuPG releases.

A crafted CMS (S/MIME) EnvelopedData message carrying an oversizedwrapped session key can cause a stack buffer overflow in gpg-agentduring the PKDECRYPT--kem=CMS handling. This can easily be usedfor a DoS but, worse, the memory corruption can very likley also beused to mount a remote code execution attack. The bug wasintroduced while changing an internal API to the FIPS required KEMAPI.

Only versions 2.5.13 through 2.5.16 are affected.