CVE-2007-1263

Description

GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 17.69% Top 10%

Vendor Advisory trustix.org Vendor Advisory fedoranews.org Vendor Advisory fedoranews.org Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com Vendor Advisory sgi.com Vendor Advisory mandriva.com Vendor Advisory redhat.com Vendor Advisory suse.com Vendor Advisory coresecurity.com

Affected: n/a n/a

References

Link	Tags
https://issues.rpath.com/browse/RPL-1111
http://www.trustix.org/errata/2007/0009/	vendor advisory
http://support.avaya.com/elmodocs2/security/ASA-2007-144.htm
http://fedoranews.org/cms/node/2776	vendor advisory
http://secunia.com/advisories/24407	third party advisory
http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html	mailing list
http://secunia.com/advisories/24438	third party advisory
http://fedoranews.org/cms/node/2775	vendor advisory
http://secunia.com/advisories/24650	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10496	vdb entry signature
http://securityreason.com/securityalert/2353	third party advisory
http://www.redhat.com/support/errata/RHSA-2007-0107.html	vendor advisory
http://www.debian.org/security/2007/dsa-1266	vendor advisory
http://www.securityfocus.com/archive/1/461958/30/7710/threaded	mailing list
http://secunia.com/advisories/24511	third party advisory
http://www.ubuntu.com/usn/usn-432-1	vendor advisory
http://www.coresecurity.com/?action=item&id=1687	patch vendor advisory
http://www.securityfocus.com/archive/1/461958/100/0/threaded	mailing list
http://secunia.com/advisories/24734	third party advisory
http://secunia.com/advisories/24419	third party advisory
http://secunia.com/advisories/24544	third party advisory
http://www.ubuntu.com/usn/usn-432-2	vendor advisory
http://secunia.com/advisories/24420	third party advisory
http://secunia.com/advisories/24875	third party advisory
ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc	vendor advisory
http://secunia.com/advisories/24365	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:059	vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-0106.html	vendor advisory
http://www.securityfocus.com/bid/22757	vdb entry
http://www.securitytracker.com/id?1017727	vdb entry
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0008.html	vendor advisory
http://www.vupen.com/english/advisories/2007/0835	vdb entry
http://secunia.com/advisories/24489	third party advisory

Frequently Asked Questions

What is the severity of CVE-2007-1263?: CVE-2007-1263 has been scored as a medium severity vulnerability.
How to fix CVE-2007-1263?: To fix CVE-2007-1263, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-1263 being actively exploited in the wild?: It is possible that CVE-2007-1263 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~18% probability that this vulnerability will be exploited by malicious actors in the next 30 days.