CVE-2007-1264: Medium severity Enigmail Enigmail vulnerability
Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-1264?
CVE-2007-1264 is considered a medium severity vulnerability due to its potential to allow remote message forgery.
How do I fix CVE-2007-1264?
To fix CVE-2007-1264, you should upgrade Enigmail to version 0.95 or later, which addresses the vulnerability.
What systems are affected by CVE-2007-1264?
CVE-2007-1264 affects Enigmail versions 0.94.2 and earlier.
What type of attacks can exploit CVE-2007-1264?
CVE-2007-1264 can be exploited through crafted OpenPGP messages that may lead to message content forgery.
Is there a workaround for CVE-2007-1264?
There is no official workaround for CVE-2007-1264; upgrading to a secure version is recommended.