CVE-2017-17846
HighSummary
An issue was discovered in Enigmail before 1.9.9 related to regular expressions that can be exploited for Denial of Service by attempting to match arbitrarily long strings.
Risk Assessment
An attacker can exploit this vulnerability to cause service outages, potentially impacting the availability of the application.
Recommendation
It is recommended to update Enigmail to version 1.9.9 or later to mitigate this vulnerability.
Other vulnerabilities in Enigmail
See all- CVE-2017-17848High
An issue was discovered in Enigmail before version 1.9.9 related to signature spoofing in multipart/related messages. A signed message part can be referenced with a cid: URI but not actually displayed, leading to the entire message appearing signed while the recipient does not see any of the signed text.
- CVE-2017-17847High
An issue was discovered in Enigmail before 1.9.9 related to signature spoofing. The UI does not properly distinguish between an attachment signature and a signature that applies to the entire containing message, which may lead to unauthorized message authentication.
- CVE-2017-17845High
An issue was discovered in Enigmail before 1.9.9 related to improper random secret generation. The use of Math.Random() by pretty Easy privacy (pEp) leads to this vulnerability.
Original NVD description (English source)
An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long strings, aka TBE-01-003.