CVE-2018-12019

7.5 highEPSS 2.1%

High (7.5) in enigmail enigmail. EPSS 2.1% chance of exploitation in the next 30 days.

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE: CWE-347
Published: 2018-06-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

enigmail:enigmail

References

http://openwall.com/lists/oss-security/2018/06/13/10
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
http://seclists.org/fulldisclosure/2019/Apr/38
http://www.openwall.com/lists/oss-security/2019/04/30/4
https://github.com/RUB-NDS/Johnny-You-Are-Fired

Check your stack JSON