[Pkg-mozext-maintainers] Bug#929363: enigmail: CVE-2019-12269

[Salvatore Bonaccorso]

Source: enigmail
Version: 2:2.0.10+ds1-1
Severity: important
Tags: security upstream
Forwarded: https://sourceforge.net/p/enigmail/bugs/983/

Hi,

The following vulnerability was published for enigmail.

CVE-2019-12269[0]:
| Enigmail before 2.0.11 allows PGP signature spoofing: for an inline
| PGP message, an attacker can cause the product to display a "correctly
| signed" message indication, but display different unauthenticated
| text.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-12269
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12269
[1] https://sourceforge.net/p/enigmail/bugs/983/

Please adjust the affected versions in the BTS as needed, probably
every version as well before 2:2.0.10+dfs1-1 would be affected.

Regards,
Salvatore