The Microsoft Outlook.com application before 7.8.2.12.49.7090 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Outlook.com | Microsoft | * | 7.8.2.12.49.6434 (including) |
| Outlook.com | Microsoft | 7.8.2.10.47.7365 (including) | 7.8.2.10.47.7365 (including) |
| Outlook.com | Microsoft | 7.8.2.11.48.4848 (including) | 7.8.2.11.48.4848 (including) |
| Outlook.com | Microsoft | 7.8.2.12.49.0430 (including) | 7.8.2.12.49.0430 (including) |
| Outlook.com | Microsoft | 7.8.2.12.49.5701 (including) | 7.8.2.12.49.5701 (including) |