Enigmail vulnerabilities
4 known CVE vulnerabilities in Enigmail, translated and rated.
- CVE-2017-17848High
An issue was discovered in Enigmail before version 1.9.9 related to signature spoofing in multipart/related messages. A signed message part can be referenced with a cid: URI but not actually displayed, leading to the entire message appearing signed while the recipient does not see any of the signed text.
- CVE-2017-17847High
An issue was discovered in Enigmail before 1.9.9 related to signature spoofing. The UI does not properly distinguish between an attachment signature and a signature that applies to the entire containing message, which may lead to unauthorized message authentication.
- CVE-2017-17846High
An issue was discovered in Enigmail before 1.9.9 related to regular expressions that can be exploited for Denial of Service by attempting to match arbitrarily long strings.
- CVE-2017-17845High
An issue was discovered in Enigmail before 1.9.9 related to improper random secret generation. The use of Math.Random() by pretty Easy privacy (pEp) leads to this vulnerability.