Enigmail 0.94.1

Released 2006-08-06, works with Thunderbird 1.5 and SeaMonkey 1.0

Enhancements:

    * Added support for automatic creation of Detached signatures for attachments.

Bugs fixed:

    * Check the list of 15 fixed bugs

I have released Enigmail v0.94.2 for Thunderbird 1.5 and Seamonkey 1.0.

I fixed a bug that could lead Thunderbird and Seamonkey to crash with
large inline PGP messages. The bug affects all versions of Enigmail. The
chances that this bug could be exploited are rather low (see below);
nevertheless I strongly recommend to upgrade Enigmail to the latest version.

Details
=======

A message object containing the decrypted data is deleted from memory
before it is sure that all contained information are completely read.
Since reading the decrypted message data is running in a separate thread
than the memory cleanup, it is impossible to predict the moment at which
the object is deleted (CPU speed, free memory etc have an influence).
Therefore it is not very likely that the crash could be used to
introduce malicious code.

Resolution
==========

The attached patch deletes the wrong code that removes the object from
memory. The code that correctly removes the data from memory is already
present, such that the patch is very small.

Download
========

Enigmail is available from: http://enigmail.mozdev.org/download.html
Source code: http://enigmail.mozdev.org/source.html

-Patrick

Выделить код

Код:

Index: enigmail.js
===================================================================
RCS file: /cvs/enigmail/src/package/enigmail.js,v
retrieving revision 1.190
diff -u -r1.190 enigmail.js
--- enigmail.js	8 Jul 2006 16:16:50 -0000	1.190
+++ enigmail.js	11 Jan 2007 10:33:04 -0000
@@ -883,9 +883,6 @@
 
       DEBUG_LOG("enigmail.js: EnigmailProtocolHandler.newChannel: messageURL="+messageUriObj.originalUrl+", "+contentType+", "+contentCharset+"\n");
 
-      if (!messageUriObj.persist)
-        delete gEnigmailSvc._messageIdList[messageId];
-
     } else {
 
       contentType = "text/plain";

Enigmail 0.94.3

Released 2007-03-06, works with Thunderbird 1.5 and SeaMonkey 1.1

Bugs fixed:

    * Enigmail is prone to a vulnerability in how signature verification information is shown to the end user. An attacker is able to add arbitrary content to a signed message. The receiver of the message will not be able to distinguish the forged and the properly signed parts of the message. Please read the security advisory by Core Security Technologies for full details.

Enigmail 0.95.0

Released 2007-04-13, works with Thunderbird 2.0 and SeaMonkey 1.1

Enhancements:

    * Preferences overhaul, simplified menu set and choice of preferences for non-advanced users.
    * The default for PGP/MIME is now a per-identity setting.
    * Better support for GnuPG 2.0.x and gpg-agent.
    * The following languages are included in the official release of Enigmail (apart from en-US): ca-AD, de-AT, de-DE, el, es-ES, fi-FI, fr-FR, hu-HU, it-IT, nb-NO, pl-PL

Bugs fixed:

    * Check the list of 17 fixed reported bugs
    * Plus many more small bugs

Enigmail 0.95.1

Released 2007-06-07, works with Thunderbird 2.0 and SeaMonkey 1.1

Enhancements:

    * Added again more languages. The following languages are now included:
      en-US, ca-AD, de-AT, de-DE, el, es-ES, fi-FI, fr-FR, hu-HU, it-IT, ja-JP, ko-KR, nb-NO, pl-PL, pt-BR, pt-PT, ru-RU, sl-SI, sv-SE, zh-CN

Bugs fixed:

    * PGP/MIME message scrambled if password not typed correct on first try. (bug 16895)
    * Incorrect installation on Mac OS X with PowerPC and Seamonkey

Enigmail 0.95.2

Released 2007-06-29, works with Thunderbird 2.0 and SeaMonkey 1.1

Enhancements:

    * Added Czech language (cs-CZ). The following languages are now included:
      en-US, ca-AD, cs-CZ, de-AT, de-DE, el, es-ES, fi-FI, fr-FR, hu-HU, it-IT, ja-JP, ko-KR, nb-NO, pl-PL, pt-BR, pt-PT, ru-RU, sl-SI, sv-SE, zh-CN

Bugs fixed:

    * Fixed broken Spanish (es-ES) language pack.

Enigmail 0.95.3

Released 2007-08-04, works with Thunderbird 2.0 and SeaMonkey 1.1

Bugs fixed:

    * Solved incompatibility with gpg4win v1.1.1.

Enigmail 0.95.4

Released 2007-10-17, works with Thunderbird 2.0 and SeaMonkey 1.1

Enhancements:

    * Added Turkish (tr-TR) and Chinese Traditional (zh-TW) languages.
    * Enhanced compatibility with other extensions (backported Mozilla bug 321890).
    * Fixed verification of inline PGP mails encoded with "quoted-printable"
    * Enabled decryption and verification of inline PGP mails when viewing messages as HTML.

Bugs fixed:

    * Solved incompatibility with GPGOL (bug 17394).
    * Various minor GUI fixes.

Enigmail 0.95.5

Released 2007-10-27, works with Thunderbird 2.0 and SeaMonkey 1.1

Bugs fixed:

    * PGP/MIME doesn't work with 0.95.4 and no passphrase on key (bug 17995).

Enigmail 0.95.6

Released 2008-01-03, works with Thunderbird 2.0 and SeaMonkey 1.1

Bugs fixed:

    * Enigmail 0.95.5 unusable with German Seamonkey (bugs 18269 and 18403).
    * Enigmail 0.95.5 unusable with Korean Thunderbird (bug 18267).
    * Incorrect quoted-printable encoding for ISO-2022-JP charset (bug 18361).
    * I am using a non English Character Set and my signatures keep failing (bug 18148).

Enigmail 0.95.7

Released 2008-08-13, works with Thunderbird 2.0.x and SeaMonkey 1.1.x

Enhancements:

    * Added Arabic (ar) and Slovak (sk-SK) languages; updated Japanese language.

Bugs fixed:

    * Missing PowerPC libenigmime.dylib library on SeaMonkey installations (bug 18657).
    * "Re-wrap signed HTML" option not persisting (bug 19658).
    * Fixed wrong default value for format=flowed.

Enigmail 0.96.0

Released 2009-07-17, works with Thunderbird 2.0.x and SeaMonkey 1.1.x

Enhancements:

    * Improvements to the main user interface for decrypting messages.
    * Use gpg groups as target for email addresses and rules.
    * Option to automatically attach signing key to sent messages.
    * Allow to send encrypted messages to newsgroups.
    * New displaying of keys in the Enigmail key manager.

Bugs fixed:

    * A total of 81(!) bugs were fixed in this release.

Enigmail 1.0.0

Released 2009-11-30, works with Thunderbird 3.0.x and SeaMonkey 2.0.1 and newer.

Enhancements:

    * Full compatibility with Thunderbird 3.0.
    * New icons to better match Thunderbird and SeaMonkey theme.

Bugs fixed:

    * A total of 31 bugs were fixed in this release.

Enigmail 1.0.1

Released 2010-01-31, works with Thunderbird 3.0.x and SeaMonkey 2.0.1 and newer.

Enhancements:

    * New translations for cs-CZ, nl-NL, pt-BR and pl-PL.

Bugs fixed:

    * This release contains for 3 important bugs.

Enigmail 1.1

Released 2010-05-31, works with Thunderbird 3.1 and SeaMonkey 2.1a1.

Enhancements:

    * New translations for tr-TR and vi-VN.

Bugs fixed:

    * Check the list of fixed defects.

Enigmail 1.1.1

Released 2010-06-25, works with Thunderbird 3.1.

Bugs fixed:

    Check the list of fixed defects.
    Fixed dialog for adding per-recipient rules in pt-BR, ja-JP and pl-PL.

Enigmail 1.1.2

Released 2010-06-29, works with Thunderbird 3.1.

Bugs fixed:

    Check the list of fixed defects.

Enigmail 1.2

Released 2011-06-28, works with Thunderbird 5.0 and SeaMonkey 2.1.

Celebrating the 10th Anniversary of Enigmail!

Enhancements:

    Full compatibility with Thunderbird 5.0
    Verification of detached signatures
    New OpenPGP status column in the message list
    Ability to sort columns in key manager
    Included support for Linux x64

Bugs fixed:

    Check the list of fixed defects.

Known issues:

    Most translations are incomplete. This will be fixed soon in a new release.

Enigmail 1.4

Released 2012-03-02, works with Thunderbird 10.0 - 11.0 and SeaMonkey 2.7 - 2.8.

Notable changes:

    This version introduces a new library for inter-process communication with GnuPG that is less platform-dependent than the old library. Up to now the library is known to work on Windows, Linux, Mac OS X, Solaris and some versions of FreeBSD.
    Please read the announcement message if you want to help with adding support for an operating system not mentioned above.

Bugs fixed:

    Check the list of fixed defects.

Enigmail 1.4.5

Released 2012-10-04, works with Thunderbird 16.0 and SeaMonkey 2.13

Bugs fixed:

    Check the list of fixed defects.

Enigmail 1.5

Released 2012-12-27, works with Thunderbird 17.0 & newer and SeaMonkey 2.16 & newer.

Notable changes:

    PGP/MIME encryption & signing has been rewritten from scratch in JavaScript.
    Core parts of inline-PGP (creation, decryption and verification) have been rewritten in JavaScript.

Bugs fixed:

    Check the list of fixed defects.

Enigmail 1.5.1

Released 2013-02-05, works with Thunderbird 17.0 & newer and SeaMonkey 2.16 & newer.

Notable changes:

    This is a bugfix release.
    Core parts of inline-PGP (creation, decryption and verification) have been rewritten in JavaScript.

Bugs fixed:

    Check the list of fixed defects.

Enigmail 1.5.2

Released 2013-07-03, works with Thunderbird 17.0 & newer and SeaMonkey 2.16 & newer.

Notable changes:

    This is a bugfix release.

Bugs fixed:

    Check the list of fixed defects.

Enigmail 1.6

Released 2013-10-07, works with Thunderbird 17.0 & newer and SeaMonkey 2.16 & newer.

Notable changes:

    The setup wizard can download and install GnuPG as part of the setup process.
    The passphrase timeout configuration in Enigmail is read and written from/to gpg-agent.
    New dialog to change the expiry date of keys.
    New function to search for the OpenPGP keys of all Address Book entries on a keyserver.

Bugs fixed:

    Check the list of fixed defects.

Enigmail 1.7

Released 2014-07-12, works with Thunderbird 24.0 & newer and SeaMonkey 2.26 & newer.

Notable changes:

    Convenience mode for sending mails
    Automatic encryption if all keys are known
    More intuitive view of encryption/signing states in icons and menus; partially new icons
    Filter in key selection dialog
    Better selection options for importing keys from address book
    Some support for PGP/MIME mails deformed by Exchange servers
    Menu items and labels changed from "OpenPGP" to "Enigmail"
    Better algorithm for selecting best key for an email address
    More finer-grained options for displaying dialog before message sending
    Better fault tolerance at many places
    Better compatibility with Linux distributions: it is no longer required to have Enigmail and Thunderbird from the same source

Bugs fixed:

    Lots of fixed bugs! Check the list of fixed defects.

Enigmail 1.7.2

Released 2014-08-29, works with Thunderbird 24.0 & newer and SeaMonkey 2.26 & newer.

Notable changes:

    This is a bugfix release.

Bugs fixed:

    Several important bugs were fixed. Check the list of fixed defects.

Enigmail 1.8

Released 2015-03-17, works with Thunderbird 31.0 & newer and SeaMonkey 2.29 & newer.

Notable Changes

    Improved user interface for message composition
    Simplified setup wizard
    Possibility to permanently decrypt messages via filter rules
    Improved support for PGP/MIME messages from GPGTools sent from MS Exchange Server
    Many bugs fixed

Important Note

This is the last major version of Enigmail to support GnuPG v1.4.x. Enigmail v1.9 and later will require GnuPG 2.0.7 or later.

Bugs fixed

Many bugs were fixed. Check the list of fixed defects.

Enigmail 1.8.1

Released 2015-03-23, works with Thunderbird 31.0 & newer and SeaMonkey 2.29 & newer.

Notable Changes

    This release addresses some critical defects around saving drafts

Important Note

This is the last major version of Enigmail to support GnuPG v1.4.x. Enigmail v1.9 and later will require GnuPG 2.0.7 or later.

Bugs fixed

Many bugs were fixed. Check the list of fixed defects.

Enigmail 1.8.2

Released 2015-04-16, works with Thunderbird 31.0 & newer and SeaMonkey 2.29 & newer.

Notable Changes

    This is a bugfix release

Important Note

This is the last major version of Enigmail to support GnuPG v1.4.x. Enigmail v1.9 and later will require GnuPG 2.0.7 or later.

Bugs fixed

Many bugs were fixed. Check the list of fixed defects.