CVE-2010-3618: Medium severity PGP Desktop For Windows vulnerability
PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an additional message to the end of a legitimately signed message, related to a "piggy-back" or "unsigned data injection" issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3618?
CVE-2010-3618 is considered a high severity vulnerability due to its potential to spoof signed data.
How do I fix CVE-2010-3618?
To fix CVE-2010-3618, upgrade to PGP Desktop 10.0.3 SP2 or 10.1.0 SP1 or later.
Which versions of PGP Desktop are affected by CVE-2010-3618?
CVE-2010-3618 affects PGP Desktop versions 10.0.0 to 10.0.3 SP1 and 10.1.0 before 10.1.0 SP1.
What type of attack does CVE-2010-3618 allow?
CVE-2010-3618 allows remote attackers to spoof signed data through manipulation of multi-packet OpenPGP messages.
Is this vulnerability present in both Windows and Mac versions of PGP Desktop?
Yes, CVE-2010-3618 is present in both the Windows and Mac versions of PGP Desktop.