UnratedFix available
gnupg2, gpgme1.0 — security advisory
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
- Products
- gnupg2, gpgme1.0
- Affected versions
- Not specified
- Fixed versions
- 1.1.2-3, 2.0.3-1
- CVEs
- CVE-2007-1263
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 15:44 UTC · Revision 1
Source evidence
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
osv:DEBIAN-CVE-2007-1263
gnupg2
Fixed versions: 2.0.3-1
gnupg2
Fixed versions: 2.0.3-1
gnupg2
Fixed versions: 2.0.3-1
gpgme1.0
Fixed versions: 1.1.2-3
gpgme1.0
Fixed versions: 1.1.2-3
gpgme1.0
Fixed versions: 1.1.2-3
Complete source record
{
"id": "ff9cf688645b78dac649341ac0014bbb0532f3a263277622281940772d911c73",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2007-1263",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2007-1263",
"summary": "GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.",
"evidence": "osv:DEBIAN-CVE-2007-1263",
"products": [
{
"name": {
"value": "gnupg2",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.3-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "gnupg2",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.3-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "gnupg2",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.3-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "gpgme1.0",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.1.2-3",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "gpgme1.0",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.1.2-3",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "gpgme1.0",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.1.2-3",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2007-1263",
"aliases": [
"DEBIAN-CVE-2007-1263"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3-1"
}
]
}
],
"package": {
"name": "gnupg2",
"purl": "pkg:deb/debian/gnupg2?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-1263.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3-1"
}
]
}
],
"package": {
"name": "gnupg2",
"purl": "pkg:deb/debian/gnupg2?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-1263.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3-1"
}
]
}
],
"package": {
"name": "gnupg2",
"purl": "pkg:deb/debian/gnupg2?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-1263.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.2-3"
}
]
}
],
"package": {
"name": "gpgme1.0",
"purl": "pkg:deb/debian/gpgme1.0?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-1263.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.2-3"
}
]
}
],
"package": {
"name": "gpgme1.0",
"purl": "pkg:deb/debian/gpgme1.0?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-1263.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.2-3"
}
]
}
],
"package": {
"name": "gpgme1.0",
"purl": "pkg:deb/debian/gpgme1.0?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-1263.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-21T17:47:31.302004147Z",
"provider": "osv",
"upstream": [
"CVE-2007-1263"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2007-1263"
]
},
"related_cves": [
{
"value": "CVE-2007-1263",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 398240,
"published_at": "2007-03-06T20:19:00+00:00"
}