Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

encfs versions before 1.7.5 can leak encrypted data

CVE-2014-3462 · published 9 years ago
Summary

The configuration file used by encfs can be altered so that the program stops protecting parts of each encrypted block. An attacker who can change this file could read the original information. Update encfs to version 1.7.5 or later, or replace the configuration file with a trusted copy, to prevent this risk.

What to do
  • Update debian encfs to version 1.8.1-1.
  • Update encfs_project encfs to version 1.7.5 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian encfs < 1.8.1-1
Fix: upgrade to 1.8.1-1
Debian:13 debian encfs < 1.8.1-1
Fix: upgrade to 1.8.1-1
– opensuse leap 42.1
42.2
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
– opensuse opensuse 13.2
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
– encfs_project encfs < 1.7.5
cpe:2.3:a:encfs_project:encfs:*:*:*:*:*:*:*:*
Original advisory text
The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes".
The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes".
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published7 Aug 2017
Updated31 Oct 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2014-3462 · OSV
CVE-2014-3462 · NVD
Track software like this
Free during beta