CVE-2007-1263

NameCVE-2007-1263
DescriptionGnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1266-1
NVD severitymedium (attack range: remote)
Debian Bugs413922, 414170

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gnupg (PTS)jessie (security), jessie1.4.18-7+deb8u5fixed
gnupg2 (PTS)jessie (security), jessie2.0.26-6+deb8u2fixed
stretch (security), stretch2.1.18-8~deb9u2fixed
buster, sid2.2.10-1fixed
gpgme1.0 (PTS)jessie1.5.1-6fixed
stretch1.8.0-3fixed
buster, sid1.11.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gnupgsource(unstable)1.4.6-2low413922
gnupgsourcesarge1.4.1-1.sarge7mediumDSA-1266-1
gnupg2source(unstable)2.0.3-1medium
gpgme1.0source(unstable)1.1.2-3low414170

Notes

[sarge] - gnupg2 <no-dsa> (Minor issue)
[etch] - gnupg2 <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems