CVE-2019-12269

HIGH

Enigmail < 2.0.11 - PGP Signature Spoofing via Inline Message Manipulation

Title source: llm

Description

Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display different unauthenticated text.

References (6)

Core 6

Core References

Release Notes, Vendor Advisory x_refsource_misc

https://www.enigmail.net/index.php/en/download/changelog

Exploit, Third Party Advisory x_refsource_misc

https://sourceforge.net/p/enigmail/bugs/983/

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00061.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CYWBJHSBBLAHKMRWDWH2XXQDYAGDHB5I/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVNTEF3WSOOQYKMIPEH7F77UPXES5BU5/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GHC5WDQ47FQSL5CTGQUYIHVC3RNZ7UH5/

Scores

CVSS v3 7.5

EPSS 0.0118

EPSS Percentile 63.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-347

Status published

Products (1)

enigmail/enigmail < 2.0.11

Published May 21, 2019

Tracked Since Feb 18, 2026