CVE-2017-17846: Input Validation
Published Dec 22, 2017
·Updated
An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long strings, aka TBE-01-003.
Affected Software
4 affected componentsFixes available
debian/enigmail
2:2.2.4-0.2~deb10u12:2.1.3+ds1-4~deb10u22:2.2.4-0.3
Enigmail Enigmail<1.9.9
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Event History
Dec 22, 2017
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2017-17846.
2
What is the severity level of CVE-2017-17846?
The severity level of CVE-2017-17846 is high, with a value of 7.5.
3
What is the impact of CVE-2017-17846?
CVE-2017-17846 can be exploited for Denial of Service attacks due to regular expressions attempts to match arbitrarily long strings.
4
Which software versions are affected by CVE-2017-17846?
The affected software versions are Enigmail before 1.9.9 and Debian Linux versions 8.0 and 9.0.
5
How can I fix CVE-2017-17846?
To fix CVE-2017-17846, you should update Enigmail to version 1.9.9 or above, or update your Debian Linux to a fixed version.