Enigmail
11 CVEs across 1 Enigmail products. Browse Enigmail vulnerabilities, severities, and proof-of-concept exploits.
Enigmail products with known CVEs
Enigmail CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2019-14664 | Medium | 6.5 | 2019-08-05 | In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can… |
CVE-2019-12269 | High | 7.5 | 2019-05-21 | Enigmail before 2.0.11 allows PGP signature spoofing: for an inline PGP message, an attacker can cause the product to display a "correctly signed" message indi… |
CVE-2018-15586 | Medium | 6.5 | 2019-02-11 | Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted mu… |
CVE-2018-12019 | High | 7.5 | 2018-06-13 | The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of m… |
CVE-2017-17848 | High | 7.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signe… |
CVE-2017-17847 | High | 7.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature… |
CVE-2017-17846 | High | 7.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long stri… |
CVE-2017-17845 | High | 7.3 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random() is used by pretty Easy privacy (pEp), aka TBE-… |
CVE-2017-17844 | Medium | 6.5 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block (that the attacker cannot d… |
CVE-2017-17843 | Medium | 5.9 | 2017-12-27 | An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regula… |
CVE-2014-5369 | | | 2014-09-08 | Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain… |
CVE-2007-1264 | | | 2007-03-06 | Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distinguishing between si… |
CVE-2006-5877 | | | 2007-02-23 | The enigmail extension before 0.94.2 does not properly handle large, encrypted file e-mail attachments, which allows remote attackers to cause a denial of serv… |
CVE-2005-3256 | | | 2005-10-18 | The key selection dialogue in Enigmail before 0.92.1 can incorrectly select a key with a user ID that does not have additional information, which allows partie… |