GNU Gpgme vulnerabilities

2 CVEs affecting GNU Gpgme, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-3564, published 2014-10-20.

More from GNU.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2007-1263, published 2007-03-06. Medium severity, CVSS 5.0. EPSS: 5.5% chance of exploitation in the next 30 days. GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might…
• CVE-2014-3564, published 2014-10-20. Medium severity, CVSS 6.8. EPSS: 4.3% chance of exploitation in the next 30 days. Multiple heap-based buffer overflows in the status_handler function in (1) engine-gpgsm.c and (2) engine-uiserver.c in GPGME before 1.5.1 allow remote attackers to cause a denial of service (crash)…