{"id":"CVE-2017-17843","aliases":["DEBIAN-CVE-2017-17843","DLA-1219-1","DSA-4070-1","EUVD-2017-8990","GHSA-cqjh-6c6c-f9gc","MGASA-2017-0477","UBUNTU-CVE-2017-17843"],"status":"published","title":"An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of...","description":"An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01119,"percentile":0.66349,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-12-21T00:00:00Z","modified":"2026-08-04T05:48:19Z","fixes":[{"ecosystem":"Debian:11","package":"enigmail","fixed_in":["2:1.9.9-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"enigmail","fixed_in":["2:1.9.9-0ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"enigmail","fixed_in":["2:1.9.9-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1~deb7u1"}]}],"versions":["2:1.4.1-2","2:1.4.1exp-1","2:1.4.5+id16-1","2:1.4.6+id16-1","2:1.4.6+id17-1","2:1.5.0+id17-1","2:1.5.0+id17-2","2:1.5.1+id17-1","2:1.5.1+id17-2","2:1.5.1+id17-3","2:1.5.1+id17-3~deb7u1","2:1.5.1+id17-4","2:1.6+git0.20140323-1","2:1.6+git0.20140323-2","2:1.6-1","2:1.6-2","2:1.6-3","2:1.6-4","2:1.6-4~deb7u1","2:1.7-1","2:1.7.2-1","2:1.7.2-1~deb7u1","2:1.7.2-2","2:1.7.2-3","2:1.7~git0.20140707-1","2:1.8-1","2:1.8.1-1","2:1.8.2-1","2:1.8.2-2","2:1.8.2-3","2:1.8.2-4","2:1.8.2-4~deb7u1","2:1.8.2-4~deb7u2","2:1.8.2-4~deb8u1","2:1.8.2~beta3-1","2:1.9-1","2:1.9.1-1","2:1.9.1-2","2:1.9.2-1","2:1.9.3-1","2:1.9.3-2","2:1.9.4-1","2:1.9.5-1","2:1.9.5-2","2:1.9.5-3","2:1.9.5-4","2:1.9.5-5","2:1.9.5-6","2:1.9.5-7","2:1.9.6-1","2:1.9.6-2","2:1.9.7-1","2:1.9.7-2","2:1.9.8-1","2:1.9.8.1-1","2:1.9.8.1-1~deb7u1","2:1.9.8.1-1~deb8u1","2:1.9.8.1-1~deb9u1","2:1.9.8.2-1","2:1.9.8.2-2","2:1.9.8.3-1","2:1.9~beta1-1","2:1.9~beta2-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:8","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1~deb8u1"}]}],"versions":["2:1.7.2-3","2:1.8-1","2:1.8.1-1","2:1.8.2-1","2:1.8.2-2","2:1.8.2-3","2:1.8.2-4","2:1.8.2-4~deb7u1","2:1.8.2-4~deb7u2","2:1.8.2-4~deb8u1","2:1.8.2~beta3-1","2:1.9-1","2:1.9.1-1","2:1.9.1-2","2:1.9.2-1","2:1.9.3-1","2:1.9.3-2","2:1.9.4-1","2:1.9.5-1","2:1.9.5-2","2:1.9.5-3","2:1.9.5-4","2:1.9.5-5","2:1.9.5-6","2:1.9.5-7","2:1.9.6-1","2:1.9.6-2","2:1.9.7-1","2:1.9.7-2","2:1.9.8-1","2:1.9.8.1-1","2:1.9.8.1-1~deb7u1","2:1.9.8.1-1~deb8u1","2:1.9.8.1-1~deb9u1","2:1.9.8.2-1","2:1.9.8.2-2","2:1.9.8.3-1","2:1.9.9-1~deb7u1","2:1.9~beta1-1","2:1.9~beta2-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:9","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1~deb9u1"}]}],"versions":["2:1.9.7-2","2:1.9.8-1","2:1.9.8.1-1","2:1.9.8.1-1~deb7u1","2:1.9.8.1-1~deb8u1","2:1.9.8.1-1~deb9u1","2:1.9.8.2-1","2:1.9.8.2-2","2:1.9.8.3-1","2:1.9.9-1~deb7u1","2:1.9.9-1~deb8u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga6"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga6"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-0ubuntu0.14.04.1"}]}],"versions":["2:1.5.2-0ubuntu1","2:1.7-0ubuntu0.14.04.1","2:1.7.2-0ubuntu0.14.04.1","2:1.8.2-0ubuntu0.14.04.1","2:1.9.7-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-0ubuntu0.16.04.1"}]}],"versions":["2:1.8.2-0ubuntu1","2:1.8.2-4fakesync1","2:1.9.1-1","2:1.9.7-1~ubuntu0.16.04.1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"enigmail","product":"enigmail"}],"references":[{"url":"https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-security-announce/2017/msg00333.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.debian.org/security/2017/dsa-4070","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17843"},{"url":"https://www.mail-archive.com/enigmail-users@enigmail.net/msg04280.html","tags":["report"]},{"url":"https://github.com/advisories/GHSA-cqjh-6c6c-f9gc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-17843","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0477.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22251","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-17843","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-17843","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-17843","description":"An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.","status":"published","published":"2017-12-22T23:00:00Z","modified":"2024-08-05T21:06:48.85Z","updated_at":"2026-11-02T14:33:18.556155Z"}],"euvd":[{"id":"EUVD-2017-8990","description":"An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.","status":"published","published":"2017-12-22T23:00:00Z","modified":"2024-08-05T21:06:48Z","updated_at":"2026-11-03T02:23:08.488418Z"}],"ghsa":[{"id":"GHSA-cqjh-6c6c-f9gc","title":"An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of...","description":"An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.","status":"published","published":"2022-05-13T01:44:30Z","modified":"2025-04-20T03:51:33Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:01:57.945283Z"}],"nvd":[{"id":"CVE-2017-17843","description":"An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.","status":"published","published":"2017-12-27T17:08:19.67Z","modified":"2026-06-17T01:11:45.44Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:11.215487Z"}],"osv":[{"id":"CVE-2017-17843","description":"An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.","status":"published","published":"2017-12-27T17:08:19.67Z","modified":"2026-04-16T06:22:25.26726523Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-17843","description":"An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.","status":"published","published":"2017-12-27T17:08:19.67Z","modified":"2026-08-04T05:48:19.727838634Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-17843","description":"An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.","status":"published","published":"2017-12-27T17:08:00Z","modified":"2025-07-16T07:36:27.364396Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"DLA-1219-1","title":"enigmail - security update","status":"published","published":"2017-12-23T00:00:00Z","modified":"2026-03-09T01:01:31.645668Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4070-1","title":"enigmail - security update","status":"published","published":"2017-12-21T00:00:00Z","modified":"2026-03-09T01:19:12.102939Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0477","title":"Updated thunderbird packages fix security vulnerabilities","description":"Multiple vulnerabilities have been fixed in thunderbird.\n* JavaScript Execution via RSS in mailbox:// origin (CVE-2017-7846).\n* Local path string can be leaked from RSS feed (CVE-2017-7847).\n* RSS Feed vulnerable to new line Injection (CVE-2017-7848).\n* Mailsploit From address with encoded null character is cut off in\nmessage header display (CVE-2017-7829).\n\nMultiple vulnerabilities have been fixed in the bundled enigmail package.\n* An issue was discovered that allows remote attackers to trigger use of\nan intended public key for encryption, because incorrect regular\nexpressions are used for extraction of an e-mail address from a\ncomma-separated list (CVE-2017-17843).\n* A remote attacker can obtain cleartext content by sending an encrypted\ndata block to a victim, and relying on the victim to automatically\ndecrypt that block and then send it back to the attacker as quoted text\n(CVE-2017-17844).\n* An issue was discovered where Improper Random Secret Generation occurs\nbecause Math.Random() is used by pretty Easy privacy (pEp)\n(CVE-2017-17845).\n* An issue was discovered where regular expressions are exploitable for\nDenial of Service, because of attempts to match arbitrarily long strings\n(CVE-2017-17846).\n* An issue was discovered that signature spoofing is possible because\nthe UI does not properly distinguish between an attachment signature,\nand a signature that applies to the entire containing message\n(CVE-2017-17847).\n* In a variant of CVE-2017-17847, signature spoofing is possible for\nmultipart/related messages because a signed message part can be\nreferenced with a cid: URI but not actually displayed (CVE-2017-17848)\n","status":"published","published":"2017-12-31T00:10:15Z","modified":"2026-05-16T06:30:52.454698Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}