Hello,

Gpg4win version 4.0.4 is released!

<https://www.gpg4win.org/download.html>

A severe bug has been found in libksba, the library used
by GnuPG for parsing the ASN.1 structures as used by S/MIME.
The bug ( https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html
CVE-2022-3515) affects all versions of libksba before 1.6.2
and may be used for remote code execution.

*Updating to this new version is thus important*.

It is important to us that Gpg4win continues to be available
as Free Software which can be downloaded anonymously without
costs. Because we know that this is the only way for some
people to get a software product which enables them to protect
their communication. As Gpg4win maintenance needs to be funded
nevertheless, we recommend that you set the price for yourself
that shows the value of Gpg4win.

For use with official documents with VS-NfD / EU / NATO RESTRICTED
classification gnupg.com offers the option to obtain the approved
GnuPG VS-Desktop version.

Details about Gpg4win 4.0.4:

<https://files.gpg4win.org/README-4.0.4.en.txt>

Highlights in Gpg4win Version 4.0.4 (2022-10-17)
-------------------------------------------
* GnuPG: Security update to 2.3.8 to fix CVE-2022-3515.
* Kleopatra: Multiple improvements related to accessibility and user
experience.
* GpgOL: An issue has been fixed which could cause delays when viewing
unencrypted mails.

On 10/18/2022 9:42 AM, Yamn Remailer wrote:
> Hello,
>
> Gpg4win version 4.0.4 is released!
>
> <https://www.gpg4win.org/download.html>
>
> A severe bug has been found in libksba, the library used
> by GnuPG for parsing the ASN.1 structures as used by S/MIME.
> The bug ( https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html
> CVE-2022-3515) affects all versions of libksba before 1.6.2
> and may be used for remote code execution.
>
> *Updating to this new version is thus important*.
>
>
> It is important to us that Gpg4win continues to be available
> as Free Software which can be downloaded anonymously without
> costs. Because we know that this is the only way for some
> people to get a software product which enables them to protect
> their communication. As Gpg4win maintenance needs to be funded
> nevertheless, we recommend that you set the price for yourself
> that shows the value of Gpg4win.
>
> For use with official documents with VS-NfD / EU / NATO RESTRICTED
> classification gnupg.com offers the option to obtain the approved
> GnuPG VS-Desktop version.
>
> Details about Gpg4win 4.0.4:
>
> <https://files.gpg4win.org/README-4.0.4.en.txt>
>
>
> Highlights in Gpg4win Version 4.0.4 (2022-10-17)
> -------------------------------------------
> * GnuPG: Security update to 2.3.8 to fix CVE-2022-3515.
> * Kleopatra: Multiple improvements related to accessibility and user
> experience.
> * GpgOL: An issue has been fixed which could cause delays when viewing
> unencrypted mails.
>

I've been away for a while due to health issues. Just came back looking
to see if there is a new version of GPG4win. Got a new pc, now, too,
and don't have the old GPG version on this pc, yet. Everything I do
have is set up for being portable on a thumb drive. I'm guessing my
keys are old, too. I downloaded the new version you posted, here, and
have been reading documentation. Haven't installed it yet. I think my
brain is going to explode because it's been a couple years since I've
messed with my old GPG!

On Wed, 19 Oct 2022 14:42:33 -0500, btdt <btdt@fall.invalid> wrote:

>On 10/18/2022 9:42 AM, Yamn Remailer wrote:
>> Hello,
>>
>> Gpg4win version 4.0.4 is released!
>>
>> <https://www.gpg4win.org/download.html>
>>
>> A severe bug has been found in libksba, the library used
>> by GnuPG for parsing the ASN.1 structures as used by S/MIME.
>> The bug ( https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html
>> CVE-2022-3515) affects all versions of libksba before 1.6.2
>> and may be used for remote code execution.
>>
>> *Updating to this new version is thus important*.
>>
>>
>> It is important to us that Gpg4win continues to be available
>> as Free Software which can be downloaded anonymously without
>> costs.

That's a lie.

It cannot be downloaded unless you make a "donation" - I think the
minimum cost was $15.

I don't give a damn if it takes $$, time and effort to keep it going.
That's no reason for claiming it's free - it ain't.

>That's a lie.

No its not !
Look again, there is another choice, "To Donate Zero dollars."

If I was more financial, I would donate.

Look closer Hal before you hit the keyboard.

On Thu, 20 Oct 2022 00:18:47 +0100, Yamn Remailer <noreply@mixmin.net>
wrote:

>>That's a lie.
>
>No its not !
>Look again, there is another choice, "To Donate Zero dollars."
>
>If I was more financial, I would donate.
>
>Look closer Hal before you hit the keyboard.

I'll be darned. You're right. I didn't even notice it. I guess I was
blinded by all the $ signs.

Oh, well, it's only Wednesday. I still got 3-4 days left in the week
to get something right for once. :o(

On 10/19/2022 1:49 PM, Hal@invalid.com wrote:

> That's a lie.
>
> It cannot be downloaded unless you make a "donation" - I think the
> minimum cost was $15.
>
> I don't give a damn if it takes $$, time and effort to keep it going.

> That's no reason for claiming it's free - it ain't.

Learn to read before you post.

I just downloaded and selected $0.