SB2019111454 - Fedora EPEL 7 update for thunderbird-enigmail

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019111454

SB2019111454 - Fedora EPEL 7 update for thunderbird-enigmail

Published: November 14, 2019 Updated: April 25, 2025

Security Bulletin ID SB2019111454
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2019-14664)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to gain access to potentially sensitive information.

This vulnerability exists due to the insufficient validation of PGP encrypted emails. A remote attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email, trick a victim to reply to this (benign looking) email and gain unauthorized access to sensitive information on the system.

This attack variant bypasses protection mechanisms implemented after the "EFAIL" attacks.


2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2019-12269)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote non-authenticated attacker to manipulate data.

Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display different unauthenticated text.


Remediation

Install update from vendor's website.

References