CVE catalog

CVE-2018-12019

UBUNTU-CVE-2018-12019

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.06% · Oct 25, 2026

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianenigmail112:2.0.7-1fixed
Suseenigmaillinux enterprise workstation extension 152.0.7-3.7.2fixed
Ubuntuenigmail16.042:1.8.2-0ubuntu1vulnerable
Ubuntuenigmail16.042:1.8.2-4fakesync1vulnerable
Ubuntuenigmail16.042:1.9.1-1vulnerable
Ubuntuenigmail16.042:1.9.7-1~ubuntu0.16.04.1vulnerable
Ubuntuenigmail16.042:1.9.9-0ubuntu0.16.04.1vulnerable
Ubuntuenigmail16.042:2.0.3-0ubuntu2~16.04.1vulnerable
Ubuntuenigmail16.042:2.0.6-0ubuntu1~16.04.1vulnerable
Ubuntuenigmail16.042:2.0.7-0ubuntu1~16.04.1vulnerable
Ubuntuenigmail16.042:2.0.8-1~ubuntu0.16.04.2vulnerable
Ubuntuenigmail16.042:2.1.6+ds1-1~ubuntu0.16.04.1vulnerable
Ubuntuenigmail18.042:1.9.8.3-1vulnerable
Ubuntuenigmail18.042:1.9.9-1vulnerable
Ubuntuenigmail18.042:1.9.9-2vulnerable
Ubuntuenigmail18.042:2.0.3-0ubuntu2~18.04.1vulnerable
Ubuntuenigmail18.042:2.0.6-0ubuntu1~18.04.1vulnerable
Ubuntuenigmail18.042:2.0.7-0ubuntu1~18.04.1vulnerable
Ubuntuenigmail18.042:2.0.8-1~ubuntu0.18.04.2vulnerable
Ubuntuenigmail18.042:2.1.2-0ubuntu1~18.04.2vulnerable
Ubuntuenigmail18.042:2.1.6+ds1-1~ubuntu0.18.04.1vulnerable
Ubuntuenigmail18.042:2.2.4-0ubuntu0.18.04.1vulnerable
Ubuntuenigmail20.042:2.1.2-0ubuntu1vulnerable
Ubuntuenigmail20.042:2.1.3+ds1-3vulnerable
Ubuntuenigmail20.042:2.1.3+ds1-4vulnerable
Ubuntuenigmail20.042:2.1.5+ds1-1vulnerable
Ubuntuenigmail20.042:2.1.6+ds1-1vulnerable
Ubuntuenigmail20.042:2.2.4-0ubuntu0.20.04.1vulnerable
Ubuntuenigmail22.042:2.2.4-0.3vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianenigmaildeb112:2.0.7-1Not reportedDEBIAN-CVE-2018-12019Not reported
Suseenigmailrpmlinux enterprise workstation extension 152.0.7-3.7.2Not reportedSUSE-SU-2018:2243-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]