CVE-2017-17848

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
https://lists.debian.org/debian-lts-announce/2017/12/msg00021.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-security-announce/2017/msg00333.htmlMailing List, Third Party Advisory
https://sourceforge.net/p/enigmail/bugs/709/Third Party Advisory
https://www.debian.org/security/2017/dsa-4070Third Party Advisory
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
https://lists.debian.org/debian-lts-announce/2017/12/msg00021.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-security-announce/2017/msg00333.htmlMailing List, Third Party Advisory
https://sourceforge.net/p/enigmail/bugs/709/Third Party Advisory
https://www.debian.org/security/2017/dsa-4070Third Party Advisory

Timeline

Published: Dec 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-178499.8A buffer overflow vulnerability in GetGo Download Manager 5.3.0.2712 and earlier could allow remote HTTP servers to execute arbitrary code o CVE-2017-17854.3IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information. IBM X-F CVE-2017-178507.5An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP me CVE-2017-178527.8kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly hav CVE-2017-178537.8kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly hav CVE-2017-178547.8kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (integer overflow and memory corrup CVE-2017-178557.8kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly hav CVE-2017-178567.8kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly hav CVE-2017-178577.8The check_stack_boundary function in kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of servic CVE-2017-178587.8Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote attacker to potential CVE-2017-178596.1Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive in CVE-2017-17865.3IBM WebSphere MQ 8.0 through 8.0.0.8 and 9.0 through 9.0.4 under special circumstances could allow an authenticated user to consume all reso