{"id":"CVE-2018-12019","aliases":["DEBIAN-CVE-2018-12019","EUVD-2018-4010","GHSA-fc79-j7vw-6xjg","MGASA-2018-0316","MGASA-2018-0321","MGASA-2018-0354","SUSE-SU-2018:2243-1","UBUNTU-CVE-2018-12019","openSUSE-SU-2024:10736-1"],"status":"published","title":"The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control...","description":"The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02059,"percentile":0.81446,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2018-06-13T23:00:00Z","modified":"2026-08-04T06:04:20Z","fixes":[{"ecosystem":"Debian:11","package":"enigmail","fixed_in":["2:2.0.7-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.0.7-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.1-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.1-1.mga6"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.6-1.4.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"rootcerts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180411.00-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.1-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.1-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.9.1-1.1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-3.7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.8.2-0ubuntu1","2:1.8.2-4fakesync1","2:1.9.1-1","2:1.9.7-1~ubuntu0.16.04.1","2:1.9.9-0ubuntu0.16.04.1","2:2.0.3-0ubuntu2~16.04.1","2:2.0.6-0ubuntu1~16.04.1","2:2.0.7-0ubuntu1~16.04.1","2:2.0.8-1~ubuntu0.16.04.2","2:2.1.6+ds1-1~ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.9.8.3-1","2:1.9.9-1","2:1.9.9-2","2:2.0.3-0ubuntu2~18.04.1","2:2.0.6-0ubuntu1~18.04.1","2:2.0.7-0ubuntu1~18.04.1","2:2.0.8-1~ubuntu0.18.04.2","2:2.1.2-0ubuntu1~18.04.2","2:2.1.6+ds1-1~ubuntu0.18.04.1","2:2.2.4-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:2.1.2-0ubuntu1","2:2.1.3+ds1-3","2:2.1.3+ds1-4","2:2.1.5+ds1-1","2:2.1.6+ds1-1","2:2.2.4-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:2.2.4-0.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1.4"}]}],"bundled":5}],"products":[{"vendor":"enigmail","product":"enigmail"}],"references":[{"url":"http://openwall.com/lists/oss-security/2018/06/13/10","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.enigmail.net/index.php/en/download/changelog","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence","web"]},{"url":"http://www.openwall.com/lists/oss-security/2019/04/30/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2019/Apr/38","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/RUB-NDS/Johnny-You-Are-Fired","tags":["x_refsource_MISC","x_transferred","package"]},{"url":"https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12019"},{"url":"https://github.com/advisories/GHSA-fc79-j7vw-6xjg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-12019","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0316.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23277","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/52.9.0/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/52.9.1/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-18/","tags":["advisory"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-05/msg00133.html","tags":["web"]},{"url":"https://neopg.io/blog/enigmail-signature-spoof/","tags":["web","report"]},{"url":"https://neopg.io/blog/gpg-signature-spoof/","tags":["web"]},{"url":"https://sourceforge.net/p/enigmail/forum/announce/thread/b948279f/","tags":["web","report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-06/msg00094.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0321.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23303","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2018-0354.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23415","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-08/msg00050.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182243-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1094781","tags":["report"]},{"url":"https://bugzilla.suse.com/1096745","tags":["report"]},{"url":"https://bugzilla.suse.com/1097525","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12020","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-12019","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12019","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12269","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-12019","description":"The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.","status":"published","published":"2018-06-13T23:00:00Z","modified":"2024-08-05T08:24:03.616Z","updated_at":"2026-11-02T14:35:06.320867Z"}],"euvd":[{"id":"EUVD-2018-4010","description":"The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.","status":"published","published":"2018-06-13T23:00:00Z","modified":"2024-08-05T08:24:03Z","updated_at":"2026-11-03T02:39:53.575925Z"}],"ghsa":[{"id":"GHSA-fc79-j7vw-6xjg","title":"The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control...","description":"The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.","status":"published","published":"2022-05-14T01:01:32Z","modified":"2023-02-02T05:03:06Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:51:33.931227Z"}],"nvd":[{"id":"CVE-2018-12019","description":"The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.","status":"published","published":"2018-06-13T23:29:00.393Z","modified":"2026-06-17T01:37:00.36Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:04:29.837913Z"}],"osv":[{"id":"CVE-2018-12019","description":"The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.","status":"published","published":"2018-06-13T23:29:00.393Z","modified":"2026-04-16T06:18:43.973651551Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-12019","description":"The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.","status":"published","published":"2018-06-13T23:29:00.393Z","modified":"2026-08-04T06:04:20.054784558Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"UBUNTU-CVE-2018-12019","description":"The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.","status":"published","published":"2018-06-13T23:29:00Z","modified":"2025-10-24T04:47:03Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"MGASA-2018-0316","title":"Updated thunderbird packages fix security vulnerabilities","description":"The updated packages fix several bugs and some security issues:\n\nBuffer overflow using computed size of canvas element. (CVE-2018-12359)\n\nUse-after-free when using focus(). (CVE-2018-12360)\n\nS/MIME and PGP decryption oracles can be built with HTML emails.\n(CVE-2018-12372)\n\nS/MIME plaintext can be leaked through HTML reply/forward. (CVE-2018-12373)\n\nInteger overflow in SSSE3 scaler. (CVE-2018-12362)\n\nUse-after-free when appending DOM nodes. (CVE-2018-12363)\n\nCSRF attacks through 307 redirects and NPAPI plugins. (CVE-2018-12364)\n\nCompromised IPC child process can list local filenames. (CVE-2018-12365)\n\nInvalid data handling during QCMS transformations. (CVE-2018-12366)\n\nUsing form to exfiltrate encrypted mail part by pressing enter in form field.\n(CVE-2018-12374)\n\nMemory safety bugs fixed in Firefox 60, Firefox ESR 60.1, Firefox ESR 52.9,\nand Thunderbird 52.9. (CVE-2018-5188)\n\nThe signature verification routine in Enigmail before 2.0.7 interprets user\nids as status/control messages and does not correctly keep track of the\nstatus of multiple signatures, which allows remote attackers to spoof\narbitrary email signatures via public keys containing crafted primary user\nids. (CVE-2018-12019)\n\nmainproc.c in GnuPG before 2.2.8 mishandles the original filename during\ndecryption and verification actions, which allows remote attackers to spoof\nthe output that GnuPG sends on file descriptor 2 to other programs that use\nthe \"--status-fd 2\" option. For example, the OpenPGP data might represent an\noriginal filename that contains line feed characters in conjunction with\nGOODSIG or VALIDSIG status codes. (CVE-2018-12020)\n","status":"published","published":"2018-07-23T22:27:34Z","modified":"2026-04-16T06:24:51.717355204Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2018-0321","title":"Updated thunderbird packages fix security vulnerabilities","description":"The updated packages fix several bugs and some security issues:\n\nBuffer overflow using computed size of canvas element. (CVE-2018-12359)\n\nUse-after-free when using focus(). (CVE-2018-12360)\n\nS/MIME and PGP decryption oracles can be built with HTML emails.\n(CVE-2018-12372)\n\nS/MIME plaintext can be leaked through HTML reply/forward. (CVE-2018-12373)\n\nInteger overflow in SSSE3 scaler. (CVE-2018-12362)\n\nUse-after-free when appending DOM nodes. (CVE-2018-12363)\n\nCSRF attacks through 307 redirects and NPAPI plugins. (CVE-2018-12364)\n\nCompromised IPC child process can list local filenames. (CVE-2018-12365)\n\nInvalid data handling during QCMS transformations. (CVE-2018-12366)\n\nUsing form to exfiltrate encrypted mail part by pressing enter in form field.\n(CVE-2018-12374)\n\nMemory safety bugs fixed in Firefox 60, Firefox ESR 60.1, Firefox ESR 52.9,\nand Thunderbird 52.9. (CVE-2018-5188)\n\nThe signature verification routine in Enigmail before 2.0.7 interprets user\nids as status/control messages and does not correctly keep track of the\nstatus of multiple signatures, which allows remote attackers to spoof\narbitrary email signatures via public keys containing crafted primary user\nids. (CVE-2018-12019)\n\nmainproc.c in GnuPG before 2.2.8 mishandles the original filename during\ndecryption and verification actions, which allows remote attackers to spoof\nthe output that GnuPG sends on file descriptor 2 to other programs that use\nthe \"--status-fd 2\" option. For example, the OpenPGP data might represent an\noriginal filename that contains line feed characters in conjunction with\nGOODSIG or VALIDSIG status codes. (CVE-2018-12020)\n","status":"published","published":"2018-07-23T22:27:34Z","modified":"2026-04-16T06:22:33.864921592Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"MGASA-2018-0354","title":"Updated thunderbird packages fix security vulnerabilities","description":"Updated thunderbird package fixes security vulnerabilities:\n\n* Spoofing of Email signatures II: The signature verification routine in\n  Enigmail interpreted User IDs as status/control messages and did not\n  correctly keep track of the status of multiple signatures. This allowed\n  remote attackers to spoof arbitrary email signatures via public keys\n  containing crafted primary user ids (CVE-2018-12019).\n\n* Spoofing of Email signatures I: GnuPG 2.2.8 fixed a security bug that\n  allows remote attackers to spoof arbitrary email signatures via the\n  embedded \"--filename\" parameter in OpenPGP literal data packets. This\n  release of Enigmail prevents the exploit for all versions of GnuPG,\n  i.e. also if GnuPG is not updated (CVE-2018-12020).\n","status":"published","published":"2018-08-23T23:35:07Z","modified":"2026-04-16T06:24:42.015539921Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10736-1","title":"enigmail-2.2.4-1.4 on GA media","description":"These are all security issues fixed in the enigmail-2.2.4-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:09:52.409086Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:2243-1","title":"Security update for enigmail","description":"This update for enigmail to 2.0.7 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2018-12020: Mitigation against GnuPG signature spoofing:\n  Email signatures could be spoofed via an embedded '--filename'\n  parameter in OpenPGP literal data packets. This update prevents\n  this issue from being exploited if GnuPG was not updated\n  (boo#1096745)\n- CVE-2018-12019: The signature verification routine interpreted\n  User IDs as status/control messages and did not correctly keep\n  track of the status of multiple signatures. This allowed remote\n  attackers to spoof arbitrary email signatures via public keys\n  containing crafted primary user ids (boo#1097525)\n- Disallow plaintext (literal packets) outside of encrpyted packets\n- Replies to a partially encrypted message may have revealed\n  protected information - no longer display PGP/MIME message\n  part followed by unencrypted data (bsc#1094781)\n- Fix signature Spoofing via Inline-PGP in HTML Mails\n\nThese non-security issues were fixed:\n\n- Fix filter actions forgetting selected mail folder names\n- Fix compatibility issue with Thunderbird 60b7\n","status":"published","published":"2018-08-07T16:05:05Z","modified":"2026-02-04T04:35:32.546316Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}