{"id":"CVE-2017-17848","aliases":["DEBIAN-CVE-2017-17848","DLA-1219-1","DSA-4070-1","EUVD-2017-8995","GHSA-gvxj-mgw2-9vg3","MGASA-2017-0477","UBUNTU-CVE-2017-17848"],"status":"published","title":"An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature...","description":"An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01843,"percentile":0.79148,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2017-12-21T00:00:00Z","modified":"2026-08-04T05:48:33Z","fixes":[{"ecosystem":"Debian:11","package":"enigmail","fixed_in":["2:1.9.9-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"enigmail","fixed_in":["2:1.9.9-0ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"enigmail","fixed_in":["2:1.9.9-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1~deb7u1"}]}],"versions":["2:1.4.1-2","2:1.4.1exp-1","2:1.4.5+id16-1","2:1.4.6+id16-1","2:1.4.6+id17-1","2:1.5.0+id17-1","2:1.5.0+id17-2","2:1.5.1+id17-1","2:1.5.1+id17-2","2:1.5.1+id17-3","2:1.5.1+id17-3~deb7u1","2:1.5.1+id17-4","2:1.6+git0.20140323-1","2:1.6+git0.20140323-2","2:1.6-1","2:1.6-2","2:1.6-3","2:1.6-4","2:1.6-4~deb7u1","2:1.7-1","2:1.7.2-1","2:1.7.2-1~deb7u1","2:1.7.2-2","2:1.7.2-3","2:1.7~git0.20140707-1","2:1.8-1","2:1.8.1-1","2:1.8.2-1","2:1.8.2-2","2:1.8.2-3","2:1.8.2-4","2:1.8.2-4~deb7u1","2:1.8.2-4~deb7u2","2:1.8.2-4~deb8u1","2:1.8.2~beta3-1","2:1.9-1","2:1.9.1-1","2:1.9.1-2","2:1.9.2-1","2:1.9.3-1","2:1.9.3-2","2:1.9.4-1","2:1.9.5-1","2:1.9.5-2","2:1.9.5-3","2:1.9.5-4","2:1.9.5-5","2:1.9.5-6","2:1.9.5-7","2:1.9.6-1","2:1.9.6-2","2:1.9.7-1","2:1.9.7-2","2:1.9.8-1","2:1.9.8.1-1","2:1.9.8.1-1~deb7u1","2:1.9.8.1-1~deb8u1","2:1.9.8.1-1~deb9u1","2:1.9.8.2-1","2:1.9.8.2-2","2:1.9.8.3-1","2:1.9~beta1-1","2:1.9~beta2-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:8","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1~deb8u1"}]}],"versions":["2:1.7.2-3","2:1.8-1","2:1.8.1-1","2:1.8.2-1","2:1.8.2-2","2:1.8.2-3","2:1.8.2-4","2:1.8.2-4~deb7u1","2:1.8.2-4~deb7u2","2:1.8.2-4~deb8u1","2:1.8.2~beta3-1","2:1.9-1","2:1.9.1-1","2:1.9.1-2","2:1.9.2-1","2:1.9.3-1","2:1.9.3-2","2:1.9.4-1","2:1.9.5-1","2:1.9.5-2","2:1.9.5-3","2:1.9.5-4","2:1.9.5-5","2:1.9.5-6","2:1.9.5-7","2:1.9.6-1","2:1.9.6-2","2:1.9.7-1","2:1.9.7-2","2:1.9.8-1","2:1.9.8.1-1","2:1.9.8.1-1~deb7u1","2:1.9.8.1-1~deb8u1","2:1.9.8.1-1~deb9u1","2:1.9.8.2-1","2:1.9.8.2-2","2:1.9.8.3-1","2:1.9.9-1~deb7u1","2:1.9~beta1-1","2:1.9~beta2-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:9","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-1~deb9u1"}]}],"versions":["2:1.9.7-2","2:1.9.8-1","2:1.9.8.1-1","2:1.9.8.1-1~deb7u1","2:1.9.8.1-1~deb8u1","2:1.9.8.1-1~deb9u1","2:1.9.8.2-1","2:1.9.8.2-2","2:1.9.8.3-1","2:1.9.9-1~deb7u1","2:1.9.9-1~deb8u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga6"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:6","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.5.2-1.mga6"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-0ubuntu0.14.04.1"}]}],"versions":["2:1.5.2-0ubuntu1","2:1.7-0ubuntu0.14.04.1","2:1.7.2-0ubuntu0.14.04.1","2:1.8.2-0ubuntu0.14.04.1","2:1.9.7-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.9.9-0ubuntu0.16.04.1"}]}],"versions":["2:1.8.2-0ubuntu1","2:1.8.2-4fakesync1","2:1.9.1-1","2:1.9.7-1~ubuntu0.16.04.1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"enigmail","product":"enigmail"}],"references":[{"url":"https://sourceforge.net/p/enigmail/bugs/709/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-security-announce/2017/msg00333.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2017/dsa-4070","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2019/04/30/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2019/Apr/38","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/RUB-NDS/Johnny-You-Are-Fired","tags":["x_refsource_MISC","x_transferred","package"]},{"url":"https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17848"},{"url":"https://sourceforge.net/p/enigmail/bugs/709"},{"url":"https://github.com/advisories/GHSA-gvxj-mgw2-9vg3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-17848","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0477.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22251","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-17848","tags":["report"]},{"url":"https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-17848","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-17848","description":"An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.","status":"published","published":"2017-12-22T23:00:00Z","modified":"2024-08-05T21:06:48.93Z","updated_at":"2026-11-02T14:33:18.248329Z"}],"euvd":[{"id":"EUVD-2017-8995","description":"An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.","status":"published","published":"2017-12-22T23:00:00Z","modified":"2024-08-05T21:06:48Z","updated_at":"2026-11-03T02:23:08.488418Z"}],"ghsa":[{"id":"GHSA-gvxj-mgw2-9vg3","title":"An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature...","description":"An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.","status":"published","published":"2022-05-14T01:01:33Z","modified":"2025-04-20T03:51:33Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:01:57.945283Z"}],"nvd":[{"id":"CVE-2017-17848","description":"An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.","status":"published","published":"2017-12-27T17:08:19.92Z","modified":"2026-06-17T01:11:46.063Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:04:11.215487Z"}],"osv":[{"id":"CVE-2017-17848","description":"An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.","status":"published","published":"2017-12-27T17:08:19.92Z","modified":"2026-04-16T06:22:51.291479475Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-17848","description":"An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.","status":"published","published":"2017-12-27T17:08:19.92Z","modified":"2026-08-04T05:48:33.770818684Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-17848","description":"An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.","status":"published","published":"2017-12-27T17:08:00Z","modified":"2025-07-16T07:18:17.556602Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"DLA-1219-1","title":"enigmail - security update","status":"published","published":"2017-12-23T00:00:00Z","modified":"2026-03-09T01:01:31.645668Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4070-1","title":"enigmail - security update","status":"published","published":"2017-12-21T00:00:00Z","modified":"2026-03-09T01:19:12.102939Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0477","title":"Updated thunderbird packages fix security vulnerabilities","description":"Multiple vulnerabilities have been fixed in thunderbird.\n* JavaScript Execution via RSS in mailbox:// origin (CVE-2017-7846).\n* Local path string can be leaked from RSS feed (CVE-2017-7847).\n* RSS Feed vulnerable to new line Injection (CVE-2017-7848).\n* Mailsploit From address with encoded null character is cut off in\nmessage header display (CVE-2017-7829).\n\nMultiple vulnerabilities have been fixed in the bundled enigmail package.\n* An issue was discovered that allows remote attackers to trigger use of\nan intended public key for encryption, because incorrect regular\nexpressions are used for extraction of an e-mail address from a\ncomma-separated list (CVE-2017-17843).\n* A remote attacker can obtain cleartext content by sending an encrypted\ndata block to a victim, and relying on the victim to automatically\ndecrypt that block and then send it back to the attacker as quoted text\n(CVE-2017-17844).\n* An issue was discovered where Improper Random Secret Generation occurs\nbecause Math.Random() is used by pretty Easy privacy (pEp)\n(CVE-2017-17845).\n* An issue was discovered where regular expressions are exploitable for\nDenial of Service, because of attempts to match arbitrarily long strings\n(CVE-2017-17846).\n* An issue was discovered that signature spoofing is possible because\nthe UI does not properly distinguish between an attachment signature,\nand a signature that applies to the entire containing message\n(CVE-2017-17847).\n* In a variant of CVE-2017-17847, signature spoofing is possible for\nmultipart/related messages because a signed message part can be\nreferenced with a cid: URI but not actually displayed (CVE-2017-17848)\n","status":"published","published":"2017-12-31T00:10:15Z","modified":"2026-05-16T06:30:52.454698Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}