VulnerabilityModified
CVE-2007-1263
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a…
MEDIUM 5.0EPSS 5.36%
Does this matter?
Lower severity and a low EPSS score (5.36%). Track it; it rarely justifies an emergency change on its own.
Description
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 5.36% probability · 92th percentile
- CISA KEV
- Not listed
- Affected
- gnu/gpgme · gnupg/gnupg
- Source
- cve@mitre.org
References
- ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc
- http://fedoranews.org/cms/node/2775
- http://fedoranews.org/cms/node/2776
- http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html
- http://lists.suse.com/archive/suse-security-announce/2007-Mar/0008.html
- http://secunia.com/advisories/24365
- http://secunia.com/advisories/24407
- http://secunia.com/advisories/24419
- http://secunia.com/advisories/24420
- http://secunia.com/advisories/24438
- http://secunia.com/advisories/24489
- http://secunia.com/advisories/24511
- http://secunia.com/advisories/24544
- http://secunia.com/advisories/24650
- http://secunia.com/advisories/24734
- http://secunia.com/advisories/24875
- http://securityreason.com/securityalert/2353
- http://support.avaya.com/elmodocs2/security/ASA-2007-144.htm
- http://www.coresecurity.com/?action=item&id=1687Patch, Vendor Advisory
- http://www.debian.org/security/2007/dsa-1266
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:059
- http://www.redhat.com/support/errata/RHSA-2007-0106.html
- http://www.redhat.com/support/errata/RHSA-2007-0107.html
- http://www.securityfocus.com/archive/1/461958/100/0/threaded
- http://www.securityfocus.com/archive/1/461958/30/7710/threaded
- http://www.securityfocus.com/bid/22757
- http://www.securitytracker.com/id?1017727
- http://www.trustix.org/errata/2007/0009/
- http://www.ubuntu.com/usn/usn-432-1
- http://www.ubuntu.com/usn/usn-432-2
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.