I actually audited gpg in 2006 while studying, it was an interesting project. Here are some of the results: Remotely controllable function pointer http://lists

I actually audited gpg in 2006 while studying, it was an interesting project. Here are some of the results: Remotely controllable function pointer http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000246.html http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/00024... GnuPG does not detect injection of unsigned data http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/00021... False positive signature verification in GnuPG http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000211.html http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/00021...