Ubuntu
enigmail package

  1. Bug #24592
  2. Comment #0

Comment 0 for bug 24592

Revision history for this message
In , Alexander Sack (asac) wrote :

Package: enigmail
Version: 2:0.91-4
Severity: critical
Tags: security patch

If there is a key on your keyring, that has an empty UID (no name,
e-mail address, etc.), mail may be encrypted to that UID, although the
recipient was not choosen by the user. This may lead to disclosure of
confidential data to others.

This is CAN-2005-3256.

Patch received from upstream is attached.

 - asac