SB2018061714 - SUSE Linux update for enigmail

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Spoofing attack (CVE-ID: CVE-2018-12019)

The vulnerability allows a remote attacker to conduct spoofing attack.

The vulnerability exists due to the signature verification routine interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures. A remote attacker can spoof arbitrary email signatures via public keys containing crafted primary user ids and gain access to potentially sensitive information.

2) Spoofing attack (CVE-ID: CVE-2018-12020)

The vulnerability allows a remote attacker to conduct spoofing attack.

The vulnerability exists due to an input validation flaw in the processing of filenames when displaying the filename. A remote attacker can send a signed and encrypted email message that includes the specially crafted name of the original input file, spoof status messages and fake the verification status of a signed email message.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2018-06/msg00027.html