CVE-2007-1263

NameCVE-2007-1263
DescriptionGnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1266-1
Debian Bugs413922, 414170

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gnupg2 (PTS)bullseye (security), bullseye2.2.27-2+deb11u2fixed
bookworm2.2.40-1.1fixed
sid, trixie2.2.45-2fixed
gpgme1.0 (PTS)bullseye1.14.0-1fixed
bookworm1.18.0-3fixed
sid, trixie1.24.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gnupgsourcesarge1.4.1-1.sarge7DSA-1266-1
gnupgsource(unstable)1.4.6-2low413922
gnupg2source(unstable)2.0.3-1
gpgme1.0source(unstable)1.1.2-3low414170

Notes

[sarge] - gnupg2 <no-dsa> (Minor issue)
[etch] - gnupg2 <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems