Description
An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | enigmail | 2:1.9.9-1 | — |
| Debian 9 | enigmail | 2:1.9.9-1~deb9u1 | DSA-4070-1 |
| Debian 8 | enigmail | 2:1.9.9-1~deb8u1 | DSA-4070-1 |
| Debian 7 | enigmail | 2:1.9.9-1~deb7u1 | DLA-1219-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | enigmail | 2:1.9.9-0ubuntu0.16.04.1 | — |
| Ubuntu 14.04 LTS | enigmail | 2:1.9.9-0ubuntu0.14.04.1 | — |
Advisories 2
- DSA-4070-1 enigmail - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1219-1 enigmail - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf
- https://lists.debian.org/debian-security-announce/2017/msg00333.html
- https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html
- [debian-lts-announce] 20171223 [SECURITY] [DLA 1219-1] enigmail security update mailing-list
- DSA-4070 vendor-advisory