CVE-2017-17688: Medium severity Apple Mail vulnerability

Published May 16, 2018
·
Updated

DISPUTED The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification.

Affected Software

12 affected components
Apple Mail
Apple Mail Iphone Os
Bloop Airmail
Emclient Emclient
Flipdogsolutions Maildroid
Freron Mailmate
Horde Horde Imp
Microsoft Outlook=2007
Mozilla Thunderbird
Postbox-inc Postbox
R2mail2 R2mail2
Roundcube Webmail

Event History

May 16, 2018
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Disputed
07:29 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2017-17688?

CVE-2017-17688 is a vulnerability in the OpenPGP specification that allows a Cipher Feedback Mode (CFB) malleability-gadget attack leading to plaintext exfiltration.

2

What is the severity of CVE-2017-17688?

The severity of CVE-2017-17688 is medium, with a severity value of 5.9.

3

Which software is affected by CVE-2017-17688?

The following software is affected by CVE-2017-17688: Apple Mail, Bloop Airmail, Emclient Emclient, Flipdogsolutions Maildroid, Freron Mailmate, Horde Horde Imp, Microsoft Outlook (2007 version), Mozilla Thunderbird, Postbox-inc Postbox, R2mail2 R2mail2, Roundcube Webmail.

4

How does CVE-2017-17688 work?

CVE-2017-17688 allows a malleability-gadget attack that can indirectly lead to plaintext exfiltration by exploiting the Cipher Feedback Mode (CFB) in the OpenPGP specification.

5

Are there any references for CVE-2017-17688?

Yes, you can find references for CVE-2017-17688 at the following links: http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html, http://www.securityfocus.com/bid/104162, http://www.securitytracker.com/id/1040904

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203