{"id":"CVE-2014-5369","aliases":["DEBIAN-CVE-2014-5369","EUVD-2014-5257","GHSA-9x52-v9m6-wjvv","MGASA-2014-0421","UBUNTU-CVE-2014-5369","openSUSE-SU-2024:10141-1"],"status":"published","title":"Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC...","description":"Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01938,"percentile":0.80218,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-09-08T14:00:00Z","modified":"2026-08-27T12:47:36Z","fixes":[{"ecosystem":"Debian:11","package":"enigmail","fixed_in":["2:1.7.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"enigmail","fixed_in":["2:1.7.2-0ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"enigmail","fixed_in":["1.9.6.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.7.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.2.0-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.2.0-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.2.0-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.2.0-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"thunderbird-lightning","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-1.mga3"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"libpng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.13-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"libvpx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.6-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.2-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.2.0-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.2.0-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.2.0-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.2.0-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Mageia:4","package":"thunderbird-lightning","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3-1.mga4"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.7.2-0ubuntu0.14.04.1"}]}],"versions":["2:1.5.2-0ubuntu1","2:1.7-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"enigmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6.1-1.1"}]}]}],"products":[{"vendor":"enigmail","product":"enigmail"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/60779","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/60887","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0421.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201504-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://sourceforge.net/p/enigmail/bugs/294/","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/08/22/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/08/18/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence"]},{"url":"http://secunia.com/advisories/61854","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5369"},{"url":"http://sourceforge.net/p/enigmail/bugs/294"},{"url":"http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4"},{"url":"https://github.com/advisories/GHSA-9x52-v9m6-wjvv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-5369","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14293","tags":["report"]},{"url":"https://www.mozilla.org/security/announce/2014/mfsa2014-74.html","tags":["web"]},{"url":"https://www.mozilla.org/security/announce/2014/mfsa2014-75.html","tags":["web"]},{"url":"https://www.mozilla.org/security/announce/2014/mfsa2014-76.html","tags":["web"]},{"url":"https://www.mozilla.org/security/announce/2014/mfsa2014-77.html","tags":["web"]},{"url":"https://www.mozilla.org/security/announce/2014/mfsa2014-79.html","tags":["web"]},{"url":"https://www.mozilla.org/security/announce/2014/mfsa2014-82.html","tags":["web"]},{"url":"https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html","tags":["web"]},{"url":"https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1635.html","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1647.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-5369","tags":["report"]},{"url":"http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/#b315","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5369","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5369","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-5369","description":"Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2014-09-08T14:00:00Z","modified":"2024-08-06T11:41:49.159Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2014-5257","description":"Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2014-09-08T14:00:00Z","modified":"2024-08-06T11:41:49Z","updated_at":"2026-11-03T01:57:03.276706Z"}],"ghsa":[{"id":"GHSA-9x52-v9m6-wjvv","title":"Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC...","description":"Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2022-05-17T03:20:58Z","modified":"2025-04-12T12:38:16Z","updated_at":"2026-11-02T15:01:18.41255Z"}],"nvd":[{"id":"CVE-2014-5369","description":"Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2014-09-08T14:55:03.03Z","modified":"2026-06-17T00:11:26.9Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:55.540337Z"}],"osv":[{"id":"CVE-2014-5369","description":"Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2014-09-08T14:55:03Z","modified":"2026-04-16T06:19:10.688990454Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-5369","description":"Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2014-09-08T14:55:03.03Z","modified":"2026-08-27T12:47:36.739390457Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0421","title":"Updated firefox and thunderbird packages fix security vulnerabilities","description":"Several flaws were found in the processing of malformed web content. A web\npage containing malicious content could cause Firefox or Thunderbird to crash\nor, potentially, execute arbitrary code with the privileges of the user\nrunning it (CVE-2014-1574, CVE-2014-1578, CVE-2014-1581, CVE-2014-1576,\nCVE-2014-1577).\n\nA flaw was found in the Alarm API in Firefox, which allows applications to\nschedule actions to be run in the future. A malicious web application could\nuse this flaw to bypass cross-origin restrictions (CVE-2014-1583).\n\nThis update provides Firefox and Thunderbird 31.2, which fixes these issues\nand other bugs, and also provides several new features, including WebRTC\nsupport.  The thunderbird-lightning package has also been updated to version\n3.3 which is compatible with the new Thunderbird version.\n\nAlso, Enigmail (part of the Thunderbird package) has been updated to version\n1.7.2 which contains several bugfixes including mail with only Bcc recipients\nbeing sent in plain text unexpectedly (CVE-2014-5369).\n","status":"published","published":"2014-10-25T20:23:09Z","modified":"2026-04-16T06:25:49.912587357Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10141-1","title":"enigmail-1.9.6.1-1.1 on GA media","description":"These are all security issues fixed in the enigmail-1.9.6.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:02.474859Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-5369","description":"Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2014-09-08T14:55:00Z","modified":"2025-07-16T07:32:07.678983Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}