CVE-2014-5369
8.8 High
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.005 Low
EPSS
Percentile
76.0%
Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.
| CPE | Name | Operator | Version |
|---|---|---|---|
| enigmail:enigmail | enigmail | eq | 1.7.2 |
| enigmail:enigmail | enigmail | eq | 1.7 |
References
lists.opensuse.org/opensuse-updates/2014-09/msg00004.html
lists.opensuse.org/opensuse-updates/2014-09/msg00008.html
secunia.com/advisories/60779
secunia.com/advisories/60887
secunia.com/advisories/61854
sourceforge.net/p/enigmail/bugs/294/
sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/
www.openwall.com/lists/oss-security/2014/08/18/2
www.openwall.com/lists/oss-security/2014/08/22/1
advisories.mageia.org/MGASA-2014-0421.html
security.gentoo.org/glsa/201504-01
Related
8.8 High
AI Score
Confidence
High
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.005 Low
EPSS
Percentile
76.0%