CVE-2017-13871
HighSummary
An issue was discovered in certain Apple products, including macOS before 10.13.2, related to the 'Mail' component. It allows remote attackers to read cleartext e-mail content that was intended to be protected by S/MIME encryption.
Risk Assessment
The lack of S/MIME certificate installation by the recipient poses a risk of exposing sensitive information in emails, potentially leading to privacy breaches and data security issues.
Recommendation
It is recommended that users install the appropriate S/MIME certificates and update their systems to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Mail
See all- CVE-2017-13874High
An issue was discovered in certain Apple products, including iOS before 11.2, related to the 'Mail' component. It might allow remote attackers to bypass an intended encryption protection mechanism by leveraging incorrect S/MIME certificate selection.
- CVE-2016-4689High
An issue was discovered in certain Apple products, including iOS before 10.2, related to the 'Mail' component. The issue involves the lack of user alerts for S/MIME email signatures using a revoked certificate.
- GHSA-mvxr-6m87-mv2qMedium
A vulnerability in the Mail library affects the q_value_decode and b_value_decode functions, which decode only the first RFC 2047 encoded-word in a string and use an overly greedy pattern to match the charset token. A crafted, malformed encoded-word embedded in an address display name or local part could cause incorrect decoding.
Original NVD description (English source)
An issue was discovered in certain Apple products. macOS before 10.13.2 is affected. The issue involves the "Mail" component. It allows remote attackers to read cleartext e-mail content (for which S/MIME encryption was intended) by leveraging the lack of installation of an S/MIME certificate by the recipient.