CVE-2007-1263

NameCVE-2007-1263
DescriptionGnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1266-1
NVD severitymedium (attack range: remote)
Debian Bugs413922, 414170

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gnupg (PTS)wheezy1.4.12-7+deb7u7fixed
wheezy (security)1.4.12-7+deb7u9fixed
jessie (security), jessie1.4.18-7+deb8u4fixed
gnupg2 (PTS)wheezy, wheezy (security)2.0.19-2+deb7u2fixed
jessie2.0.26-6+deb8u1fixed
stretch2.1.18-8~deb9u1fixed
buster, sid2.2.3-1fixed
gpgme1.0 (PTS)wheezy, wheezy (security)1.2.0-1.4+deb7u1fixed
jessie1.5.1-6fixed
stretch1.8.0-3fixed
buster, sid1.9.0-8fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gnupgsource(unstable)1.4.6-2low413922
gnupgsourcesarge1.4.1-1.sarge7mediumDSA-1266-1
gnupg2source(unstable)2.0.3-1medium
gpgme1.0source(unstable)1.1.2-3low414170

Notes

[sarge] - gnupg2 <no-dsa> (Minor issue)
[etch] - gnupg2 <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems