vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2017-17688

N/A
Published: May 16, 2018 at 07:00 PM UTC
Updated: June 17, 2026 at 01:11 AM UTC
11 products affected across 11 vendorsThunderbirdOutlookWebmail

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 5%

Description

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Mail· Apple
95%
All versions
Airmail· Bloop
95%
All versions
Emclient· Emclient
95%
All versions
Maildroid· Flipdogsolutions
95%
All versions
Mailmate· Freron
95%
All versions
Horde Imp· Horde
95%
All versions
Outlook· Microsoft
95%
2007
Thunderbird· Mozilla
95%
All versions
Postbox· Postbox Inc
95%
All versions
R2MAIL2· R2MAIL2
95%
All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (10)

x_refsource_MISCThird Party Advisory
Source: [email protected]
http://flaked.sockpuppet.org/2018/05/16/a-unified-timeline.html
VDB Entryx_refsource_BIDThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/104162
VDB Entryx_refsource_SECTRACKThird Party Advisory
Source: [email protected]
http://www.securitytracker.com/id/1040904
x_refsource_MISCExploitMitigationThird Party Advisory
Source: [email protected]
https://efail.de
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060334.html
x_refsource_MISCIssue TrackingThird Party Advisory
Source: [email protected]
https://news.ycombinator.com/item?id=17066419
x_refsource_MISCIssue TrackingThird Party Advisory
Source: [email protected]
https://protonmail.com/blog/pgp-vulnerability-efail
x_refsource_MISCThird Party Advisory
Source: [email protected]
https://twitter.com/matthew_d_green/status/995996706457243648

CVSS

4.3MEDIUM[email protected]
Confidentiality
PARTIAL
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card