SSL_Cipher.cpp in EncFS before 1.7.0 does not properly handle integer data sizes when constructing headers intended for randomization of initialization vectors, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms.
Conclusion & alert: CVE-2010-3073 is rated Exploit Available (50/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.16%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| 34537 | exploit_db | edb | 2010-08-26 | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2025-05-27 | 0.43% | 0.16% | -0.27% |
| 2 | 2025-03-30 | 0.57% | 0.43% | -0.14% |
| 3 | 2025-03-29 | — | 0.57% | — |
Full EPSS history (6 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 2.1 | 2.0 | LOW |
|
3.9 | 2.9 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2010-3073 not yet assigned priority: Debian including 1 source packages (encfs), 4 status rows across 4 suites (bookworm, bullseye, sid, trixie): resolved 4. | https://security-tracker.debian.org/tracker/CVE-2010-3073 |
ubuntu
|
medium | CVE-2010-3073 medium priority: Ubuntu including 1 source packages (encfs), 13 status rows across 13 suites (dapper, hardy, jaunty, karmic, lucid, maverick, natty, oneiric, precise, quantal, raring, saucy, upstream): ignored 6, not-affected 6, released 1. | https://ubuntu.com/security/CVE-2010-3073 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| arg0 | encfs | <= 1.6.0 | cpe:2.3:a:arg0:encfs:*:*:*:*:*:*:*:* |
| arg0 | encfs | 1.4.0 | cpe:2.3:a:arg0:encfs:1.4.0:*:*:*:*:*:*:* |
| arg0 | encfs | 1.4.1 | cpe:2.3:a:arg0:encfs:1.4.1:*:*:*:*:*:*:* |
| arg0 | encfs | 1.4.1.1 | cpe:2.3:a:arg0:encfs:1.4.1.1:*:*:*:*:*:*:* |
| arg0 | encfs | 1.4.2 | cpe:2.3:a:arg0:encfs:1.4.2:*:*:*:*:*:*:* |
| arg0 | encfs | 1.5.0 | cpe:2.3:a:arg0:encfs:1.5.0:*:*:*:*:*:*:* |