cve/2017/CVE-2017-17848.md

### [CVE-2017-17848](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17848)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An issue was discovered in Enigmail before 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appears to be signed, but the recipient does not see any of the signed text.

### POC

#### Reference
- http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
- https://sourceforge.net/p/enigmail/bugs/709/

#### Github
No PoCs found on GitHub currently.