CVE-2018-12019

Name of the Vulnerable Software and Affected Versions Enigmail versions prior to 2.0.7

Description The issue concerns the signature verification routine, which incorrectly interprets user ids as status/control messages and fails to track the status of multiple signatures. This allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

Recommendations For versions prior to 2.0.7, update to version 2.0.7 or later to resolve the issue.