high7.5
CVE-2017-17846
An issue was discovered in Enigmail before 1.9.9.
Impact
An issue was discovered in Enigmail before 1.9.9. Regular expressions are exploitable for Denial of Service, because of attempts to match arbitrarily long strings, aka TBE-01-003.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Enigmail | Enigmail | before 1.9.9 |
| Debian | Debian Linux | Versions 8.0, 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf
- https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html
- https://lists.debian.org/debian-security-announce/2017/msg00333.html
- https://www.debian.org/security/2017/dsa-4070
- https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html
- https://enigmail.net/download/other/Enigmail%20Pentest%20Report%20by%20Cure53%20-%20Excerpt.pdf
- https://lists.debian.org/debian-lts-announce/2017/12/msg00021.html
- https://lists.debian.org/debian-security-announce/2017/msg00333.html
- https://www.debian.org/security/2017/dsa-4070
- https://www.mail-archive.com/enigmail-users%40enigmail.net/msg04280.html