The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Apple | - (including) | - (including) | |
| Airmail | Bloop | - (including) | - (including) |
| Emclient | Emclient | - (including) | - (including) |
| Maildroid | Flipdogsolutions | - (including) | - (including) |
| Mailmate | Freron | - (including) | - (including) |
| Horde_imp | Horde | - (including) | - (including) |
| Outlook | Microsoft | 2007 (including) | 2007 (including) |
| Thunderbird | Mozilla | - (including) | - (including) |
| Postbox | Postbox-inc | - (including) | - (including) |
| R2mail2 | R2mail2 | - (including) | - (including) |
| Webmail | Roundcube | - (including) | - (including) |
| Enigmail | Ubuntu | artful | * |
| Enigmail | Ubuntu | trusty | * |
| Enigmail | Ubuntu | upstream | * |