Security bugs are reported here via bugzilla

[George Sherwood <pilot AT beernabeer.com>]

Summary
============
The Gentoo project identified a security related bug in GnuPG.  When
using any current version of GnuPG for unattended signature
verification (e.g. by scripts and mail programs), false positive
signature verification of detached signatures may occur.

This problem affects the tool *gpgv*, as well as using "gpg --verify"
to imitate gpgv, if only the exit code of the process is used to
decide whether a detached signature is valid.  This is a plausible
mode of operation for gpgv.

If, as suggested, the --status-fd generated output is used to decide
whether a signature is valid, no problem exists.  In particular
applications making use of the GPGME library[2] are not affected.

To solve this problem an update of the current stable version has been
released (see below).

Impact
======
By sending a malicious attachment to a mail server that is hooked with
clamav, a remote attacker could cause a Denial of Service or the
execution of arbitrary code.

Solution:
=========

Update GnuPG as soon as possible to version 1.4.2.1.  There are no
fixes for older versions available.

Resolution
==========
All gnupg users should upgrade to the latest available version:
        # scribe update
        # cast -c gnupg

References
============
http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000211.html