[SECURITY] [DLA 1219-1] enigmail security update

Package : enigmail Version : 2:1.9.9-1deb7u1 CVE ID : CVE-2017-17843 CVE-2017-17844 CVE-2017-17845 CVE-2017-17846 CVE-2017-17847 CVE-2017-17848 Multiple vulnerabilities were discovered in Enigmail, an OpenPGP extension for Thunderbird, which could result in a loss of confidentiality, faked...

DLA-1219-1 enigmail - security update

Bulletin has no description...

openSUSE: Security Advisory for enigmail (openSUSE-SU-2017:3427-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2017-17843

An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and ...

CVE-2017-17846

An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long strings, aka TBE-01-003...

CVE-2017-17848

CVE-2017-17848 affects Enigmail before 1.9.9. It describes signature spoofing for multipart/related messages: a signed part can be referenced with a cid: URI but not displayed, making the recipient see a signed message while none of the signed text is actually shown. Connected sources indicate fi...

CVE-2017-17843

Removed by vendor...

CVE-2017-17848

Removed by vendor...

CVE-2017-17844

Removed by vendor...

CVE-2017-17847

Removed by vendor...

CVE-2017-17846

Removed by vendor...

CVE-2017-17845

Removed by vendor...

CVE-2017-17846

CVE-2017-17846 affects Enigmail prior to 1.9.9. The issue arises because regular expressions can be used to trigger a Denial of Service by attempting to match arbitrarily long strings. In the connected advisories, this vulnerability is listed among multiple fixes for Thunderbird/Enigmail packages...

CVE-2017-17847

CVE-2017-17847 affects Enigmail prior to 1.9.9, where the UI fails to clearly distinguish an attachment signature from a signature for the entire containing message, enabling signature spoofing. The related open-source advisories and vulnerability feeds (e.g., Mageia MGASA-2017-0477, Debian DLA-1...

CVE-2017-17843

The CVE-2017-17843 issue affects Enigmail before 1.9.9, where incorrect regular expressions used to extract an e-mail address from a comma-separated list can cause the intended public key to be used for encryption. Connected sources corroborate this as part of a set of vulnerabilities fixed in Th...

CVE-2017-17844

An issue was discovered in Enigmail before 1.9.9. A remote attacker can obtain cleartext content by sending an encrypted data block that the attacker cannot directly decrypt to a victim, and relying on the victim to automatically decrypt that block and then send it back to the attacker as quoted...

CVE-2017-17845

An issue was discovered in Enigmail before 1.9.9. Improper Random Secret Generation occurs because Math.Random is used by pretty Easy privacy pEp, aka TBE-01-001...

CVE-2017-17844

CVE-2017-17844 affects Enigmail before 1.9.9, an OpenPGP extension for Thunderbird. A remote attacker can cause the victim to decrypt an encrypted block and replay the resulting cleartext as quoted text, exposing plaintext (TBE-01-005 replay). The issue is addressed in vendor advisories; remediat...

CVE-2017-17847

An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachmen...

CVE-2017-17845

CVE-2017-17845 affects Enigmail (Thunderbird extension) before 1.9.9. The issue is improper random secret generation because Math.Random() is used by pretty Easy privacy (pEp). Impact: potential confidentiality/integrity/availability concerns as per CVSS metrics (base score 7.3–7.5, HIGH). Affect...