Vulnetix
Try Vulnetix Request Demo
CVE-2017-17847 PUBLISHED

An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.

EPSS 0.29% · 52.3th percentile

Risk Scores

EPSS Score
0.29%
52.3th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSenigmail0, 2:1.5.2-0ubuntu1, 2:1.7-0ubuntu0.14.04.1
Ubuntu:16.04:LTSenigmail0, 2:1.8.2-0ubuntu1, 2:1.8.2-4fakesync1

Timeline

References

Open in Interactive Console →