What bugs have been found in PGP?
The following list of bugs is limited to version 2.4 and later, and is limited to the most commonly seen and serious bugs. For bugs in earlier versions, refer to the documentation included with the program. If you find a bug not on this list, follow the procedure above for reporting it. • MIT PGP 2.6 had a bug in the key generation process which made keys generated by it much less random. Fixed in 2.6.1. • All versions of PGP except MIT PGP 2.6.2 are susceptible to a “buglet” in clearsigned messages, making it possible to add text to the beginning of a clearsigned message. The added text does not appear in the PGP output after the signature is checked. MIT PGP 2.6.2 now does not allow header lines before the text of a clearsigned message and enforces RFC 822 syntax on header lines before the signature. Since this bug appears at checking time, however, you should be aware of this bug even if you use MIT PGP 2.6.2 – the reader may check your signed message with a different version and no
