Enigmail 0.94.1

Released 2006-08-06, works with Thunderbird 1.5 and SeaMonkey 1.0

Enhancements:

    * Added support for automatic creation of Detached signatures for attachments.

Bugs fixed:

    * Check the list of 15 fixed bugs

I have released Enigmail v0.94.2 for Thunderbird 1.5 and Seamonkey 1.0.

I fixed a bug that could lead Thunderbird and Seamonkey to crash with
large inline PGP messages. The bug affects all versions of Enigmail. The
chances that this bug could be exploited are rather low (see below);
nevertheless I strongly recommend to upgrade Enigmail to the latest version.

Details
=======

A message object containing the decrypted data is deleted from memory
before it is sure that all contained information are completely read.
Since reading the decrypted message data is running in a separate thread
than the memory cleanup, it is impossible to predict the moment at which
the object is deleted (CPU speed, free memory etc have an influence).
Therefore it is not very likely that the crash could be used to
introduce malicious code.

Resolution
==========

The attached patch deletes the wrong code that removes the object from
memory. The code that correctly removes the data from memory is already
present, such that the patch is very small.

Download
========

Enigmail is available from: http://enigmail.mozdev.org/download.html
Source code: http://enigmail.mozdev.org/source.html

-Patrick

Выделить код

Код:

Index: enigmail.js
===================================================================
RCS file: /cvs/enigmail/src/package/enigmail.js,v
retrieving revision 1.190
diff -u -r1.190 enigmail.js
--- enigmail.js	8 Jul 2006 16:16:50 -0000	1.190
+++ enigmail.js	11 Jan 2007 10:33:04 -0000
@@ -883,9 +883,6 @@
 
       DEBUG_LOG("enigmail.js: EnigmailProtocolHandler.newChannel: messageURL="+messageUriObj.originalUrl+", "+contentType+", "+contentCharset+"\n");
 
-      if (!messageUriObj.persist)
-        delete gEnigmailSvc._messageIdList[messageId];
-
     } else {
 
       contentType = "text/plain";

Enigmail 0.95.0

Released 2007-04-13, works with Thunderbird 2.0 and SeaMonkey 1.1

Enhancements:

    * Preferences overhaul, simplified menu set and choice of preferences for non-advanced users.
    * The default for PGP/MIME is now a per-identity setting.
    * Better support for GnuPG 2.0.x and gpg-agent.
    * The following languages are included in the official release of Enigmail (apart from en-US): ca-AD, de-AT, de-DE, el, es-ES, fi-FI, fr-FR, hu-HU, it-IT, nb-NO, pl-PL

Bugs fixed:

    * Check the list of 17 fixed reported bugs
    * Plus many more small bugs

Enigmail 0.95.2

Released 2007-06-29, works with Thunderbird 2.0 and SeaMonkey 1.1

Enhancements:

    * Added Czech language (cs-CZ). The following languages are now included:
      en-US, ca-AD, cs-CZ, de-AT, de-DE, el, es-ES, fi-FI, fr-FR, hu-HU, it-IT, ja-JP, ko-KR, nb-NO, pl-PL, pt-BR, pt-PT, ru-RU, sl-SI, sv-SE, zh-CN

Bugs fixed:

    * Fixed broken Spanish (es-ES) language pack.

Enigmail 0.95.4

Released 2007-10-17, works with Thunderbird 2.0 and SeaMonkey 1.1

Enhancements:

    * Added Turkish (tr-TR) and Chinese Traditional (zh-TW) languages.
    * Enhanced compatibility with other extensions (backported Mozilla bug 321890).
    * Fixed verification of inline PGP mails encoded with "quoted-printable"
    * Enabled decryption and verification of inline PGP mails when viewing messages as HTML.

Bugs fixed:

    * Solved incompatibility with GPGOL (bug 17394).
    * Various minor GUI fixes.

Enigmail 0.95.6

Released 2008-01-03, works with Thunderbird 2.0 and SeaMonkey 1.1

Bugs fixed:

    * Enigmail 0.95.5 unusable with German Seamonkey (bugs 18269 and 18403).
    * Enigmail 0.95.5 unusable with Korean Thunderbird (bug 18267).
    * Incorrect quoted-printable encoding for ISO-2022-JP charset (bug 18361).
    * I am using a non English Character Set and my signatures keep failing (bug 18148).

Enigmail 0.96.0

Released 2009-07-17, works with Thunderbird 2.0.x and SeaMonkey 1.1.x

Enhancements:

    * Improvements to the main user interface for decrypting messages.
    * Use gpg groups as target for email addresses and rules.
    * Option to automatically attach signing key to sent messages.
    * Allow to send encrypted messages to newsgroups.
    * New displaying of keys in the Enigmail key manager.

Bugs fixed:

    * A total of 81(!) bugs were fixed in this release.

Enigmail 1.0.1

Released 2010-01-31, works with Thunderbird 3.0.x and SeaMonkey 2.0.1 and newer.

Enhancements:

    * New translations for cs-CZ, nl-NL, pt-BR and pl-PL.

Bugs fixed:

    * This release contains for 3 important bugs.

Enigmail 1.1.1

Released 2010-06-25, works with Thunderbird 3.1.

Bugs fixed:

    Check the list of fixed defects.
    Fixed dialog for adding per-recipient rules in pt-BR, ja-JP and pl-PL.

Enigmail 1.2

Released 2011-06-28, works with Thunderbird 5.0 and SeaMonkey 2.1.

Celebrating the 10th Anniversary of Enigmail!

Enhancements:

    Full compatibility with Thunderbird 5.0
    Verification of detached signatures
    New OpenPGP status column in the message list
    Ability to sort columns in key manager
    Included support for Linux x64

Bugs fixed:

    Check the list of fixed defects.

Known issues:

    Most translations are incomplete. This will be fixed soon in a new release.

Enigmail 1.4.5

Released 2012-10-04, works with Thunderbird 16.0 and SeaMonkey 2.13

Bugs fixed:

    Check the list of fixed defects.

Enigmail 1.5.1

Released 2013-02-05, works with Thunderbird 17.0 & newer and SeaMonkey 2.16 & newer.

Notable changes:

    This is a bugfix release.
    Core parts of inline-PGP (creation, decryption and verification) have been rewritten in JavaScript.

Bugs fixed:

    Check the list of fixed defects.

Enigmail 1.6

Released 2013-10-07, works with Thunderbird 17.0 & newer and SeaMonkey 2.16 & newer.

Notable changes:

    The setup wizard can download and install GnuPG as part of the setup process.
    The passphrase timeout configuration in Enigmail is read and written from/to gpg-agent.
    New dialog to change the expiry date of keys.
    New function to search for the OpenPGP keys of all Address Book entries on a keyserver.

Bugs fixed:

    Check the list of fixed defects.