p PatchFirst

CVE-2017-17847

CVE-2017-17847

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.

CVSS 7.5 · High · EPSS 1.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • enigmail Debian:11

    Affected ranges
    • ECOSYSTEM: < 2:1.9.9-1

    Update to 2:1.9.9-1

  • enigmail Ubuntu:14.04:LTS

    Versions
    • 2:1.5.2-0ubuntu1
    • 2:1.7-0ubuntu0.14.04.1
    • 2:1.7.2-0ubuntu0.14.04.1
    • 2:1.8.2-0ubuntu0.14.04.1
    • 2:1.9.7-0ubuntu0.14.04.1
    Affected ranges
    • ECOSYSTEM: < 2:1.9.9-0ubuntu0.14.04.1

    Update to 2:1.9.9-0ubuntu0.14.04.1

  • enigmail Ubuntu:16.04:LTS

    Versions
    • 2:1.8.2-0ubuntu1
    • 2:1.8.2-4fakesync1
    • 2:1.9.1-1
    • 2:1.9.7-1~ubuntu0.16.04.1
    Affected ranges
    • ECOSYSTEM: < 2:1.9.9-0ubuntu0.16.04.1

    Update to 2:1.9.9-0ubuntu0.16.04.1

Original sources

Check your server →