CVE-2007-1269 GNUMail 1.1.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents GNUMail from visually distinguishing between signed and unsigned portions of OpenPGP messag...
MediumCVSS 5.0
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GNUMail 1.1.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents GNUMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnumail | <= 1.1.2 | No fix listed |
| debian/gnumail(Debian:12) | All versions | No fix listed |
| debian/gnumail(Debian:12) | = 1.3.0-1 | No fix listed |
| debian/gnumail(Debian:12) | = 1.4.0-1 | No fix listed |
| debian/gnumail(Debian:12) | = 1.4.0-2 | No fix listed |
| debian/gnumail(Debian:12) | = 1.4.0-3 | No fix listed |
| debian/gnumail(Debian:13) | All versions | No fix listed |
| debian/gnumail(Debian:13) | = 1.4.0-3 | No fix listed |
| debian/gnumail(Debian:14) | All versions | No fix listed |
| debian/gnumail(Debian:14) | = 1.4.0-3 | No fix listed |
References
- [gnupg-users] 20070306 [Announce] Multiple Messages Problem in GnuPG and GPGME mailing-list
- 24417 third-party-advisory
- 2353 third-party-advisory
- www.coresecurity.com exploit vendor-advisory
- 20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability mailing-list
- 20070305 CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability mailing-list
- 22779 vdb-entry
- 1017727 vdb-entry
- ADV-2007-0835 vdb-entry
- Debian Security Tracker CVE-2007-1269 vendor-advisory