CVE-2007-1263

NameCVE-2007-1263
DescriptionGnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1266-1
NVD severitymedium
Debian Bugs413922, 414170

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gnupg (PTS)jessie, jessie (security)1.4.18-7+deb8u5fixed
gnupg2 (PTS)jessie, jessie (security)2.0.26-6+deb8u2fixed
stretch2.1.18-8~deb9u4fixed
stretch (security)2.1.18-8~deb9u2fixed
buster2.2.12-1+deb10u1fixed
bullseye, sid2.2.17-3fixed
gpgme1.0 (PTS)jessie1.5.1-6fixed
stretch1.8.0-3fixed
buster1.12.0-6fixed
bullseye, sid1.13.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gnupgsource(unstable)1.4.6-2low413922
gnupgsourcesarge1.4.1-1.sarge7DSA-1266-1
gnupg2source(unstable)2.0.3-1
gpgme1.0source(unstable)1.1.2-3low414170

Notes

[sarge] - gnupg2 <no-dsa> (Minor issue)
[etch] - gnupg2 <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems