CVE-2007-1266 Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually distinguishing between signed and unsigned portions of OpenPGP me...
MediumCVSS 5.0
EPSS 5.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME evolution | <= 2.8.1 | No fix listed |
| debian/evolution(Debian:12) | All versions | No fix listed |
| debian/evolution(Debian:12) | = 3.46.4-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.46.4-2+deb12u1 | No fix listed |
| debian/evolution(Debian:12) | = 3.47.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.47.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.48.0-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.48.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.48.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.48.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.48.4-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.49.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.49.2-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.49.2-3 | No fix listed |
| debian/evolution(Debian:12) | = 3.49.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.50.0-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.50.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.50.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.50.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.51.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.0-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.1-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.1-3 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.1-4 | No fix listed |
Show 58 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/evolution(Debian:12) | = 3.52.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.2-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.52.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.53.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.53.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.54.0-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.54.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.54.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.54.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.54.3-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.55.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.55.1-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.55.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.55.3-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.0-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-10 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-2 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-3 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-4 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-5 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-7 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-8 | No fix listed |
| debian/evolution(Debian:12) | = 3.56.2-9 | No fix listed |
| debian/evolution(Debian:12) | = 3.62.0-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.62.1-1 | No fix listed |
| debian/evolution(Debian:12) | = 3.62.1-2 | No fix listed |
| debian/evolution(Debian:13) | All versions | No fix listed |
| debian/evolution(Debian:13) | = 3.56.1-1 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.1-1+deb13u1 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-0+deb13u1 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-1 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-10 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-2 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-3 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-4 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-5 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-7 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-8 | No fix listed |
| debian/evolution(Debian:13) | = 3.56.2-9 | No fix listed |
| debian/evolution(Debian:13) | = 3.62.0-1 | No fix listed |
| debian/evolution(Debian:13) | = 3.62.1-1 | No fix listed |
| debian/evolution(Debian:13) | = 3.62.1-2 | No fix listed |
| debian/evolution(Debian:14) | All versions | No fix listed |
| debian/evolution(Debian:14) | = 3.56.1-1 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-1 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-10 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-2 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-3 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-4 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-5 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-7 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-8 | No fix listed |
| debian/evolution(Debian:14) | = 3.56.2-9 | No fix listed |
| debian/evolution(Debian:14) | = 3.62.0-1 | No fix listed |
| debian/evolution(Debian:14) | = 3.62.1-1 | No fix listed |
| debian/evolution(Debian:14) | = 3.62.1-2 | No fix listed |
References
- Debian Security Tracker CVE-2007-1266 vendor-advisory
- [gnupg-users] 20070306 [Announce] Multiple Messages Problem in GnuPG and GPGME mailing-list
- 24412 third-party-advisory
- 2353 third-party-advisory
- www.coresecurity.com exploit patch vendor-advisory
- 20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability mailing-list
- 20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability mailing-list
- 22760 vdb-entry
- 1017727 vdb-entry
- ADV-2007-0835 vdb-entry