CVE-2019-12269
CVE-2019-12269
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display different unauthenticated text.
CVSS 7.5 · High · EPSS 1.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
enigmail Debian:11
- Affected ranges
- ECOSYSTEM: < 2:2.0.11+ds1-1
Update to 2:2.0.11+ds1-1
enigmail Ubuntu:16.04:LTS
- Versions
- 2:1.8.2-0ubuntu1
- 2:1.8.2-4fakesync1
- 2:1.9.1-1
- 2:1.9.7-1~ubuntu0.16.04.1
- 2:1.9.9-0ubuntu0.16.04.1
- 2:2.0.3-0ubuntu2~16.04.1
- 2:2.0.6-0ubuntu1~16.04.1
- 2:2.0.7-0ubuntu1~16.04.1
- 2:2.0.8-1~ubuntu0.16.04.2
- 2:2.1.6+ds1-1~ubuntu0.16.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
enigmail Ubuntu:18.04:LTS
- Versions
- 2:1.9.8.3-1
- 2:1.9.9-1
- 2:1.9.9-2
- 2:2.0.3-0ubuntu2~18.04.1
- 2:2.0.6-0ubuntu1~18.04.1
- 2:2.0.7-0ubuntu1~18.04.1
- 2:2.0.8-1~ubuntu0.18.04.2
- 2:2.1.2-0ubuntu1~18.04.2
- 2:2.1.6+ds1-1~ubuntu0.18.04.1
- 2:2.2.4-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://www.enigmail.net/index.php/en/download/changelog
- https://sourceforge.net/p/enigmail/bugs/983/
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00061.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CYWBJHSBBLAHKMRWDWH2XXQDYAGDHB5I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVNTEF3WSOOQYKMIPEH7F77UPXES5BU5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GHC5WDQ47FQSL5CTGQUYIHVC3RNZ7UH5/
- https://nvd.nist.gov/vuln/detail/CVE-2019-12269