CVE-2018-15586

MEDIUM 6.5CVE-2018-15586 · Published 11/02/2019 · updated 17/06/2026

In short

CVE-2018-15586 is a MEDIUM (CVSS 6.5) vulnerability affecting enigmail (enigmail).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 73.2% of all vulnerabilities.
Fix: update to 2.0.6 or later.

Package	Affected versions	Patched versions
enigmail enigmail	`< 2.0.6`	`2.0.6`

Description

Enigmail before 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted multipart HTML email.

References

packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html · Third Party Advisory
seclists.org/fulldisclosure/2019/Apr/38 · Mailing List
openwall.com/lists/oss-security/2019/04/30/4 · Mailing List
RUB-NDS/Johnny-You-Are-Fired
RUB-NDS/Johnny-You-Are-Fired
sourceforge.net/p/enigmail/bugs/849 · Exploit

More vulnerabilities in enigmail

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

enigmail

< 2.0.6

2.0.6

More vulnerabilities in enigmail

See all →