UBUNTU-CVE-2014-5369

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2014-5369
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-5369.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2014-5369
Upstream
Published
2014-09-08T14:55:00Z
Modified
2025-07-16T07:32:07.678983Z
Severity
  • Ubuntu - low
Summary
[none]
Details

Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.

References

Affected packages

Ubuntu:14.04:LTS / enigmail

Package

Name
enigmail
Purl
pkg:deb/ubuntu/enigmail@2:1.7.2-0ubuntu0.14.04.1?arch=source&distro=trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:1.7.2-0ubuntu0.14.04.1

Affected versions

2:1.*

2:1.5.2-0ubuntu1
2:1.7-0ubuntu0.14.04.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2:1.7.2-0ubuntu0.14.04.1",
            "binary_name": "enigmail"
        }
    ],
    "availability": "No subscription required"
}