Описание
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | released | 2:1.9.9-0ubuntu0.17.10.1 |
| devel | not-affected | 2:1.9.9-1 |
| esm-apps/xenial | released | 2:1.9.9-0ubuntu0.16.04.1 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was released [2:1.9.9-0ubuntu0.14.04.1]] |
| precise/esm | DNE | |
| trusty | released | 2:1.9.9-0ubuntu0.14.04.1 |
| trusty/esm | DNE | trusty was released [2:1.9.9-0ubuntu0.14.04.1] |
| upstream | released | 2:1.9.9-1 |
| xenial | released | 2:1.9.9-0ubuntu0.16.04.1 |
| zesty | ignored | end of life |
Показывать по
Ссылки на источники
EPSS
5 Medium
CVSS2
7.5 High
CVSS3
Связанные уязвимости
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE- ...
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
EPSS
5 Medium
CVSS2
7.5 High
CVSS3