CVE-2007-1265

KMail 1.9.5 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents KMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without...

CVE-2007-1266

CVE-2007-1266 affects Evolution 2.8.1 and earlier. The issue is that Evolution does not properly use the --status-fd argument when invoking GnuPG, preventing it from visually distinguishing between signed and unsigned portions of OpenPGP messages that have multiple components. As a result, a remo...

CVE-2007-1267

Sylpheed 2.2.7 and earlier improperly uses the --status-fd argument when invoking GnuPG, which prevents distinguishing between signed and unsigned portions of multi-component OpenPGP messages. This allows remote attackers to forge message contents without detection. Affected software and version:...

CVE-2007-1263

GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection...

CVE-2007-1264

Affected software/component : Enigmail 0.94.2 and earlier. Problem : Enigmail does not properly use the --status-fd argument when invoking GnuPG, preventing visual distinction between signed and unsigned portions of OpenPGP messages with multiple components. Impact : This can allow remote attacke...

CVE-2007-1263

CVE-2007-1263 affects GnuPG 1.4.6 and earlier and GPGME before 1.1.4. The issue is that, when parsing OpenPGP messages with multiple components, signed and unsigned portions are not visually distinguished, allowing an attacker to forge the contents of a message without detection. The vulnerabilit...

CVE-2007-1269

CVE-2007-1269 affects GNUMail 1.1.2 and earlier. The root cause is improper use of the --status-fd argument when invoking GnuPG, which prevents distinguishing between signed and unsigned portions of multi-component OpenPGP messages. This can allow remote attackers to forge message contents withou...

gnupg/gpgme signed message spoofing

GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection...

CVE-2007-1263: Undefined Security Weakness

GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection...

CVE-2007-1265: Undefined Security Weakness

KMail 1.9.5 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents KMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without...

CORE-2007-0115: GnuPG and GnuPG clients unsigned data injection vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ GnuPG and GnuPG clients unsigned data injection vulnerability Date Published: 2007-03-05 Last Update: 2007-03-05 Advisory ID: CORE-2007-0115 Bugtraq IDs: BID 22757 -...

CVE-2007-1266: Undefined Security Weakness

Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message...

CVE-2007-1268: Undefined Security Weakness

Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without...

CVE-2007-1263

GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection...

GnuPG and GnuPG clients unsigned data injection vulnerability

Advisory ID Internal CORE-2007-0115 Date Published: 2007-03-05 Last Update: 2007-03-05 Advisory ID: CORE-2007-0115 Bugtraq IDs: BID 22757 - GnuPG BID 22758 - Enigmail BID 22759 - KMail BID 22760 - Evolution BID 22777 - Sylpheed BID 22778 - Mutt BID 22779 - GNUMail CVE Names: CVE-2007-1263 for the...

GnuPG vulnerable to remote data control

Overview A vulnerability in GnuPG could allow a remote attacker to execute arbitrary code on an affected system. Description GNU Privacy Guard GnuPG is the GNU project's implementation of the OpenPGP standard as defined by RFC2440.OpenPGP messages are processed by GnuPG using data structures call...

Debian DSA-1231-1 : gnupg - several vulnerabilities

Several remote vulnerabilities have been discovered in the GNU privacy guard, a free PGP replacement, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-6169 Werner Koch discovered that a buffer overfl...

FreeBSD : gnupg -- remotely controllable function pointer (4db1669c-8589-11db-ac4f-02e081235dab)

Werner Koch reports : GnuPG uses data structures called filters to process OpenPGP messages. These filters are used in a similar way as a pipelines in the shell. For communication between these filters context structures are used. These are usually allocated on the stack and passed to the filter...

[SECURITY] [DSA 1231-1] New gnupg packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1231-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 9th, 2006 http://www.debian.org/security/faq -...

CVE-2006-6235

A "stack overwrite" vulnerability in GnuPG gpg 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory...