• info
• discussion
• exploit
• solution
• references

Mozilla Enigmail Incorrect Encryption Key Selection Vulnerability

Solution:

The vendor has released version 0.92.1 of Enigmail to address this issue.

Please see the referenced advisories for further details.


Mozilla Enigmail 0.75.1

• Mozilla enigmail_v0_92_1.patch.txt
  http://www.mozilla-enigmail.org/downloads/src/enigmail_v0_92_1.patch.t xt

Mozilla Enigmail 0.76.8

• Mozilla enigmail_v0_92_1.patch.txt
  http://www.mozilla-enigmail.org/downloads/src/enigmail_v0_92_1.patch.t xt

Mozilla Enigmail 0.89

• Mozilla enigmail_v0_92_1.patch.txt
  http://www.mozilla-enigmail.org/downloads/src/enigmail_v0_92_1.patch.t xt

Mozilla Enigmail 0.91

• Debian mozilla-enigmail_0.91-4sarge2_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_alpha.deb


• Debian mozilla-enigmail_0.91-4sarge2_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_amd64.deb


• Debian mozilla-enigmail_0.91-4sarge2_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_arm.deb


• Debian mozilla-enigmail_0.91-4sarge2_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_hppa.deb


• Debian mozilla-enigmail_0.91-4sarge2_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_i386.deb


• Debian mozilla-enigmail_0.91-4sarge2_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_ia64.deb


• Debian mozilla-enigmail_0.91-4sarge2_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_m68k.deb


• Debian mozilla-enigmail_0.91-4sarge2_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_mips.deb


• Debian mozilla-enigmail_0.91-4sarge2_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_mipsel.deb


• Debian mozilla-enigmail_0.91-4sarge2_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_powerpc.deb


• Debian mozilla-enigmail_0.91-4sarge2_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_s390.deb


• Debian mozilla-enigmail_0.91-4sarge2_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-enigma il_0.91-4sarge2_sparc.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_alpha.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_amd64.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_arm.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_hppa.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_i386.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_ia64.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_m68k.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_mips.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_mipsel.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_powerpc.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_s390.deb


• Debian mozilla-thunderbird-enigmail_0.91-4sarge2_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/e/enigmail/mozilla-thunde rbird-enigmail_0.91-4sarge2_sparc.deb