PT-2014-6435 · Enigmail · Enigmail

Henri Salo · Publicado 2014-09-08 · Atualizado 2024-06-15 · CVE-2014-5369

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Enigmail versions 1.7.x before 1.7.2

Description The issue allows remote attackers to obtain sensitive information by sniffing the network when encryption is enabled and only BCC recipients are specified, as emails are sent in plaintext.

Recommendations For Enigmail versions 1.7.x before 1.7.2, update to version 1.7.2 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2014-5369

MGASA-2014-0421

OPENSUSE-SU-2024:10141-1

Produtos afetados

Enigmail

Referências · 33

• 🔥 http://openwall.com/lists/oss-security/2014/08/18/2 · Exploit
• https://mozilla.org/security/announce/2014/mfsa2014-74.html · Aviso do Fabricante
• http://sourceforge.net/p/enigmail/bugs/294 · Correção
• https://osv.dev/vulnerability/openSUSE-SU-2024:10141-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/08/22/1 · Nota
• https://mozilla.org/security/announce/2014/mfsa2014-82.html · Aviso do Fabricante
• http://secunia.com/advisories/61854 · Nota
• https://advisories.mageia.org/MGASA-2014-0421.html · Nota de Segurança
• https://mozilla.org/security/announce/2014/mfsa2014-76.html · Aviso do Fabricante
• https://rhn.redhat.com/errata/RHSA-2014-1647.html · Nota
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00008.html · Aviso do Fabricante
• https://mozilla.org/security/known-vulnerabilities/thunderbird.html · Aviso do Fabricante
• https://mozilla.org/security/announce/2014/mfsa2014-75.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-5369 · Aviso do Fabricante
• http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/#b315 · Nota