CVE-2018-12019

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of…

published June 13, 2018

CVSS
—
EPSS
2%
Percentile
81.0
In the wild
Unconfirmed
What it is

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02059 · 81.0th percentile
Published
2018-06-13T23:00Z
EPSS history
Timeline
  • 13 JUN 23:00Z
    The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of…
    cvelistv5