{"id":"CVE-2007-1263","aliases":["DEBIAN-CVE-2007-1263","DSA-1266-1","EUVD-2007-1260","GHSA-mx49-25fh-66c8","RHSA-2007:0106","RHSA-2007:0107"],"status":"published","title":"GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually...","description":"GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05528,"percentile":0.92867,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2007-03-06T20:00:00Z","modified":"2026-10-21T17:47:31Z","exploits":[{"source":"exploitdb","id":"EDB-29689","title":"GnuPG 1.x - Signed Message Arbitrary Content Injection","type":"remote","platform":"linux","date":"2007-03-05","verified":true,"url":"https://www.exploit-db.com/exploits/29689"}],"fixes":[{"ecosystem":"Debian:12","package":"gnupg2","fixed_in":["2.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnupg2","fixed_in":["2.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnupg2","fixed_in":["2.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gpgme1.0","fixed_in":["1.1.2-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gpgme1.0","fixed_in":["1.1.2-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gpgme1.0","fixed_in":["1.1.2-3"],"sources":["osv"]},{"ecosystem":"Debian:3.1","package":"gnupg","fixed_in":["1.4.1-1.sarge7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:2.1::as","package":"gnupg","fixed_in":["0:1.0.7-21"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:2.1::aw","package":"gnupg","fixed_in":["0:1.0.7-21"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:2.1::es","package":"gnupg","fixed_in":["0:1.0.7-21"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:2.1::ws","package":"gnupg","fixed_in":["0:1.0.7-21"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"gnupg","fixed_in":["0:1.2.1-20"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"gnupg-debuginfo","fixed_in":["0:1.2.1-20"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"gnupg","fixed_in":["0:1.2.1-20"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"gnupg-debuginfo","fixed_in":["0:1.2.1-20"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"gnupg","fixed_in":["0:1.2.1-20"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"gnupg-debuginfo","fixed_in":["0:1.2.1-20"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"gnupg","fixed_in":["0:1.2.1-20"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"gnupg-debuginfo","fixed_in":["0:1.2.1-20"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"gnupg","fixed_in":["0:1.2.6-9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"gnupg-debuginfo","fixed_in":["0:1.2.6-9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"gnupg","fixed_in":["0:1.2.6-9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"gnupg-debuginfo","fixed_in":["0:1.2.6-9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"gnupg","fixed_in":["0:1.2.6-9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"gnupg-debuginfo","fixed_in":["0:1.2.6-9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"gnupg","fixed_in":["0:1.2.6-9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"gnupg-debuginfo","fixed_in":["0:1.2.6-9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg","fixed_in":["0:1.4.5-13"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg-debuginfo","fixed_in":["0:1.4.5-13"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg","fixed_in":["0:1.4.5-13"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg-debuginfo","fixed_in":["0:1.4.5-13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gpgme1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gpgme1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gpgme1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-3"}]}]},{"source":"osv","ecosystem":"Debian:3.1","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-1.sarge7"}]}],"versions":["1.4.1-1","1.4.1-1.sarge2","1.4.1-1.sarge3","1.4.1-1.sarge4","1.4.1-1.sarge5","1.4.1-1.sarge6","1.4.1-1sarge1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::as","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.7-21"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::aw","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.7-21"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::es","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.7-21"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:2.1::ws","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.7-21"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-20"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-20"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-20"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-20"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-20"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-20"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-20"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-20"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-13"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-13"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-13"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"gnupg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-13"}]}]}],"products":[{"vendor":"gnu","product":"gpgme"},{"vendor":"gnupg","product":"gnupg"}],"references":[{"url":"https://issues.rpath.com/browse/RPL-1111","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.trustix.org/errata/2007/0009/","tags":["vendor-advisory","x_refsource_TRUSTIX","x_transferred","web"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2007-144.htm","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://fedoranews.org/cms/node/2776","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/24407","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.gnupg.org/pipermail/gnupg-users/2007-March/030514.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/24438","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://fedoranews.org/cms/node/2775","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/24650","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10496","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://securityreason.com/securityalert/2353","tags":["third-party-advisory","x_refsource_SREASON","x_transferred","web"]},{"url":"http://www.redhat.com/support/errata/RHSA-2007-0107.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.debian.org/security/2007/dsa-1266","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/archive/1/461958/30/7710/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://secunia.com/advisories/24511","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/usn-432-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.coresecurity.com/?action=item\u0026id=1687","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.securityfocus.com/archive/1/461958/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://secunia.com/advisories/24734","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/24419","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/24544","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/usn-432-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/24420","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/24875","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc","tags":["vendor-advisory","x_refsource_SGI","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/24365","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2007:059","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2007-0106.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/22757","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.securitytracker.com/id?1017727","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://lists.suse.com/archive/suse-security-announce/2007-Mar/0008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2007/0835","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/24489","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-1263","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mx49-25fh-66c8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2007-1263","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2007:0106","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=230456","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0106.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2007-1263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=430489","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-1263","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2007:0107","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=230467","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0107.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2007-1263","description":"GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.","status":"published","published":"2007-03-06T20:00:00Z","modified":"2024-08-07T12:50:35.27Z","updated_at":"2026-11-02T13:33:41.472948Z"}],"euvd":[{"id":"EUVD-2007-1260","description":"GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.","status":"published","published":"2007-03-06T20:00:00Z","modified":"2024-08-07T12:50:35Z","updated_at":"2026-11-03T01:38:26.725267Z"}],"ghsa":[{"id":"GHSA-mx49-25fh-66c8","title":"GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually...","description":"GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.","status":"published","published":"2022-05-03T03:18:05Z","modified":"2023-02-01T05:01:27Z","updated_at":"2026-11-02T14:49:43.293288Z"}],"nvd":[{"id":"CVE-2007-1263","description":"GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.","status":"published","published":"2007-03-06T20:19:00Z","modified":"2026-06-16T22:37:15.307Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:13.98711Z"}],"osv":[{"id":"CVE-2007-1263","description":"GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.","status":"published","published":"2007-03-06T20:19:00Z","modified":"2026-04-10T03:38:02.029568Z","updated_at":"2026-11-02T15:43:56.865964Z"},{"id":"DEBIAN-CVE-2007-1263","description":"GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.","status":"published","published":"2007-03-06T20:19:00Z","modified":"2026-10-21T17:47:31.302004147Z","updated_at":"2026-11-02T15:45:23.105674Z"},{"id":"DSA-1266-1","title":"gnupg - several vulnerabilities","status":"published","published":"2007-03-13T00:00:00Z","modified":"2026-03-09T01:01:13.042404Z","updated_at":"2026-11-02T15:46:14.285228Z"},{"id":"RHSA-2007:0106","title":"Red Hat Security Advisory: gnupg security update","status":"published","published":"2024-09-15T16:36:46Z","modified":"2026-06-26T10:05:51Z","updated_at":"2026-11-02T15:52:59.70892Z"},{"id":"RHSA-2007:0107","title":"Red Hat Security Advisory: gnupg security update","status":"published","published":"2024-09-15T16:36:50Z","modified":"2026-06-26T10:05:51Z","updated_at":"2026-11-02T15:52:59.70892Z"}]}}