CVE catalog

CVE-2010-3075

encfs: CVE-2010-3075

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
2.06% · Oct 25, 2026

EncFS before 1.7.0 encrypts multiple blocks by means of the CFB cipher mode with the same initialization vector, which makes it easier for local users to obtain sensitive information via calculations involving recovery of XORed data, as demonstrated by an attack on encrypted data in which the last block contains only one byte.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianencfssid1.9.5-3fixed
Debianencfstrixie1.9.5-3fixed
Debianencfsbookworm1.9.5-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianencfssourcesid1.7.2-1not yet assignedNot reported[595998]
Debianencfssourcetrixie1.7.2-1not yet assignedNot reported[595998]
Debianencfssourcebookworm1.7.2-1not yet assignedNot reported[595998]

[Debian bug #595998]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [encfs]Fixed
    Details (2)

    • 1.9.5-2 · amd64 · bookworm

      Fixed · Fixed: 1.7.2-1

      dsa · encfs · debian · bookworm; dsa · encfs · debian · 12

    • 1.9.5-2 · arm64 · bookworm

      Fixed · Fixed: 1.7.2-1

      dsa · encfs · debian · bookworm; dsa · encfs · debian · 12

[Debian 13 (Trixie)]

  • [encfs]Fixed
    Details (2)

    • 1.9.5-3 · amd64 · trixie

      Fixed · Fixed: 1.7.2-1

      dsa · encfs · debian · 13

    • 1.9.5-3 · arm64 · trixie

      Fixed · Fixed: 1.7.2-1

      dsa · encfs · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]