← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to retired/CVE-2017-17848

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
retired/CVE-2017-17848
1
 
Candidate: CVE-2017-17848
2
 
PublicDate: 2017-12-27
3
 
References:
4
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17848
5
 
 https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf
6
 
 https://lists.debian.org/debian-security-announce/2017/msg00333.html
7
 
 https://sourceforge.net/p/enigmail/bugs/709/
8
 
 https://www.debian.org/security/2017/dsa-4070
9
 
Description:
10
 
 An issue was discovered in Enigmail before 1.9.9. In a variant of
11
 
 CVE-2017-17847, signature spoofing is possible for multipart/related
12
 
 messages because a signed message part can be referenced with a cid: URI
13
 
 but not actually displayed. In other words, the entire containing message
14
 
 appears to be signed, but the recipient does not see any of the signed
15
 
 text.
16
 
Ubuntu-Description:
17
 
Notes:
18
 
Bugs:
19
 
Priority: high
20
 
Discovered-by:
21
 
Assigned-to:
22
 
 
23
 
 
24
 
Patches_enigmail:
25
 
upstream_enigmail: released (2:1.9.9-1)
26
 
precise/esm_enigmail: DNE
27
 
trusty_enigmail: released (2:1.9.9-0ubuntu0.14.04.1)
28
 
xenial_enigmail: released (2:1.9.9-0ubuntu0.16.04.1)
29
 
zesty_enigmail: ignored (reached end-of-life)
30
 
artful_enigmail: released (2:1.9.9-0ubuntu0.17.10.1)
31
 
devel_enigmail: not-affected (2:1.9.9-1)