| Name | CVE-2014-5369 |
| Description | Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| enigmail | source | squeeze | (not affected) | |||
| enigmail | source | wheezy | (not affected) | |||
| enigmail | source | (unstable) | 2:1.7.2-1 |
[wheezy] - enigmail <not-affected> (Introduced in 1.7)
[squeeze] - enigmail <not-affected> (Introduced in 1.7)
http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/#b315
and http://sourceforge.net/p/enigmail/bugs/294/
fixed in 1.7.1 and 1.8.0 upstream (not yet released)