CVE-2017-17848

CVE-2017-17848 is a signature spoofing vulnerability affecting Enigmail versions prior to 1.9.9, specifically impacting multipart/related messages. An attacker can craft an email where a signed message part is referenced but not displayed, making the entire message appear legitimately signed while concealing malicious content. This vulnerability carries a CVSS score of 7.5 (High), indicating a network-based attack with low complexity that can lead to high integrity impact without requiring user interaction. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.