VulnerabilityModified

CVE-2014-5369

Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.

MEDIUM 4.3EPSS 1.94%

Does this matter?

Lower severity and a low EPSS score (1.94%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
EPSS: 1.94% probability · 79th percentile
CISA KEV: Not listed
Weakness: CWE-310
Affected: enigmail/enigmail
Source: cve@mitre.org

References

http://lists.opensuse.org/opensuse-updates/2014-09/msg00004.html
http://lists.opensuse.org/opensuse-updates/2014-09/msg00008.html
http://secunia.com/advisories/60779
http://secunia.com/advisories/60887
http://secunia.com/advisories/61854
http://sourceforge.net/p/enigmail/bugs/294/Patch
http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/
http://www.openwall.com/lists/oss-security/2014/08/18/2Exploit
http://www.openwall.com/lists/oss-security/2014/08/22/1
https://advisories.mageia.org/MGASA-2014-0421.html
https://security.gentoo.org/glsa/201504-01
http://lists.opensuse.org/opensuse-updates/2014-09/msg00004.html
http://lists.opensuse.org/opensuse-updates/2014-09/msg00008.html
http://secunia.com/advisories/60779
http://secunia.com/advisories/60887
http://secunia.com/advisories/61854
http://sourceforge.net/p/enigmail/bugs/294/Patch
http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/
http://www.openwall.com/lists/oss-security/2014/08/18/2Exploit
http://www.openwall.com/lists/oss-security/2014/08/22/1
https://advisories.mageia.org/MGASA-2014-0421.html
https://security.gentoo.org/glsa/201504-01

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.