CVE-2007-1263: gnu gpgme
- 1 reference with an unsupported link type was hidden.
Vulnerability summary
CVE-2007-1263 is a medium (CVSS 5.0) vulnerability in gnu gpgme. EPSS estimates a 5.53% chance of exploitation in the next 30 days, higher than 92.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 06-03-2007PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
5.53%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
+0.17 pp
From 5.36% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundGnuPG 1.x - Signed Message Arbitrary Content Injection
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian3 products
- gnupg< 1.4.1-1.sarge7
- gnupg2< 2.0.3-1
- gpgme1.0< 1.1.2-3
Redhat2 products
- gnupg< 0:1.0.7-21 | < 0:1.2.1-20 | < 0:1.2.6-9 | < 0:1.4.5-13
- gnupg-debuginfo< 0:1.2.1-20 | < 0:1.2.6-9 | < 0:1.4.5-13
Gnu1 product
- gpgme≤ 1.1.3
Gnupg1 product
- gnupg≤ 1.4.6
4 vendors · 7 products
References
44 links- issues.rpath.com/browse/RPL-1111X Refsource CONFIRM
- support.avaya.com/elmodocs2/security/ASA-2007-144.htmX Refsource CONFIRM
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10496VDB EntrySignatureX Refsource OVAL
