CVE-2014-5369

Published: Sep 8, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.

Affected (2)

Products: Enigmail: Enigmail

Enigmail

1 product

Enigmail

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Enigmail Enigmail	Version 1.7.2
Enigmail Enigmail	Version 1.7

Related CWEs

CWE-310

References (22)

http://lists.opensuse.org/opensuse-updates/2014-09/msg00004.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2014-09/msg00008.html

Source: cve@mitre.org

http://secunia.com/advisories/60779

Source: cve@mitre.org

http://secunia.com/advisories/60887

Source: cve@mitre.org

http://secunia.com/advisories/61854

Source: cve@mitre.org

http://sourceforge.net/p/enigmail/bugs/294/

Source: cve@mitre.org

Patch

http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2014/08/18/2

Source: cve@mitre.org

Exploit

http://www.openwall.com/lists/oss-security/2014/08/22/1

Source: cve@mitre.org

https://advisories.mageia.org/MGASA-2014-0421.html

Source: cve@mitre.org

https://security.gentoo.org/glsa/201504-01

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2014-09/msg00004.html