CVE-2017-17847: High severity enigmail vulnerability
An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17847?
CVE-2017-17847 is considered a medium severity vulnerability due to the potential for signature spoofing.
How do I fix CVE-2017-17847?
To resolve CVE-2017-17847, it is recommended to upgrade Enigmail to version 1.9.9 or later.
What type of vulnerability is CVE-2017-17847?
CVE-2017-17847 is classified as a signature spoofing vulnerability.
Which versions of Enigmail are affected by CVE-2017-17847?
Enigmail versions prior to 1.9.9 are affected by CVE-2017-17847.
Does CVE-2017-17847 affect any operating systems?
Yes, CVE-2017-17847 affects Enigmail installations on Debian Linux versions 8.0 and 9.0.