| Package | Affected versions | Patched versions |
|---|---|---|
| enigmail | < 1.9.9 | 1.9.9 |
An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free