Unscored severity · published Mar 6, 2007
CVE-2007-1263
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple…
–
CVSS
5.5%
EPSS
No
On KEV
Description
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GN
Gnupg · Gnupg
through 1.4.6 · source: NVD
GP
Gpgme · Gnu
through 1.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-1263
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-1263
fedoranews.org
http://fedoranews.org/cms/node/2775
fedoranews.org
http://fedoranews.org/cms/node/2776
lists.gnupg.org
http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html
lists.suse.com
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0008.html
secunia.com
http://secunia.com/advisories/24365
More from Gpgme
–
CVE-2014-3564
Multiple heap-based buffer overflows in the status_handler function in (1) engine-gpgsm.c and (2) engine-uiserver.c in GPGME before 1.5.1 allow remote attackers to cause a denial…