CVE-2018-12019

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

La rutina de verificación de firmas en Enigmail en versiones anteriores a la 2.0.7 interpreta los ID de usuario como mensajes de estado/control y no mantiene correctamente el control sobre el estado de múltiples firmas. Esto permite que atacantes remotos suplanten firmas de email arbitrarias mediante claves públicas que contienen ID de usuario primario manipulados.