CVE Vulnerabilities

CVE-2017-17843

Published: Dec 27, 2017 | Modified: Nov 07, 2023
CVSS 3.x
5.9
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu
HIGH

An issue was discovered in Enigmail before 1.9.9 that allows remote attackers to trigger use of an intended public key for encryption, because incorrect regular expressions are used for extraction of an e-mail address from a comma-separated list, as demonstrated by a modified Full Name field and a homograph attack, aka TBE-01-002.

Affected Software

Name Vendor Start Version End Version
Enigmail Enigmail * 1.9.9 (excluding)
Enigmail Ubuntu artful *
Enigmail Ubuntu trusty *
Enigmail Ubuntu upstream *
Enigmail Ubuntu xenial *
Enigmail Ubuntu zesty *

References