SB2019111454 - Fedora EPEL 7 update for thunderbird-enigmail
Published: November 14, 2019 Updated: April 25, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2019-14664)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
This vulnerability exists due to the insufficient validation of PGP encrypted emails. A remote attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email, trick a victim to reply to this (benign looking) email and gain unauthorized access to sensitive information on the system.
This attack variant bypasses protection mechanisms implemented after the "EFAIL" attacks.
2) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2019-12269)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indication, but display different unauthenticated text.
Remediation
Install update from vendor's website.