CVE-2014-5369
First published: Mon Sep 08 2014(Updated: )
Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Enigmail | =1.7 | |
| Enigmail | =1.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00008.html
- http://secunia.com/advisories/60779
- http://secunia.com/advisories/60887
- http://secunia.com/advisories/61854
- http://sourceforge.net/p/enigmail/bugs/294/
- http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/
- http://www.openwall.com/lists/oss-security/2014/08/18/2
- http://www.openwall.com/lists/oss-security/2014/08/22/1
- https://advisories.mageia.org/MGASA-2014-0421.html
- https://security.gentoo.org/glsa/201504-01
Frequently Asked Questions
What is the severity of CVE-2014-5369?
CVE-2014-5369 has a medium severity rating due to its potential to expose sensitive information.
How do I fix CVE-2014-5369?
To fix CVE-2014-5369, update Enigmail to version 1.7.2 or later.
What are the risks associated with CVE-2014-5369?
The risks associated with CVE-2014-5369 include the possibility of remote attackers obtaining sensitive email content by listening to network traffic.
Which versions of Enigmail are affected by CVE-2014-5369?
Enigmail versions 1.7.x prior to 1.7.2 are affected by CVE-2014-5369.
Is there a workaround for CVE-2014-5369?
A workaround for CVE-2014-5369 is to avoid sending emails with only BCC recipients while encryption is enabled until the software can be updated.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/enigmail
- canonical/enigmail
- version/enigmail/1.7
- version/enigmail/1.7.2