cve/2017/CVE-2017-17847.md

### [CVE-2017-17847](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17847)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An issue was discovered in Enigmail before 1.9.9. Signature spoofing is possible because the UI does not properly distinguish between an attachment signature, and a signature that applies to the entire containing message, aka TBE-01-021. This is demonstrated by an e-mail message with an attachment that is a signed e-mail message in message/rfc822 format.

### POC

#### Reference
- https://sourceforge.net/p/enigmail/bugs/709/

#### Github
No PoCs found on GitHub currently.