CVE-2007-1263

NameCVE-2007-1263
DescriptionGnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1266-1
NVD severitymedium
Debian Bugs413922, 414170

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gnupg2 (PTS)stretch2.1.18-8~deb9u4fixed
stretch (security)2.1.18-8~deb9u2fixed
buster2.2.12-1+deb10u1fixed
bookworm, sid, bullseye2.2.27-2fixed
gpgme1.0 (PTS)stretch1.8.0-3fixed
buster1.12.0-6fixed
bullseye1.14.0-1fixed
bookworm, sid1.16.0-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gnupgsourcesarge1.4.1-1.sarge7DSA-1266-1
gnupgsource(unstable)1.4.6-2low413922
gnupg2source(unstable)2.0.3-1
gpgme1.0source(unstable)1.1.2-3low414170

Notes

[sarge] - gnupg2 <no-dsa> (Minor issue)
[etch] - gnupg2 <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems