CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8708
https://notcve.org/view.php?id=CVE-2015-8708
Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8614. Desbordamiento de buffer basado en pila en la función conv_euctojis en codeconv.c en Claws Mail 3.13.1 permite a atacantes remotos tener un impacto no especificado a través de un correo electrónico manipulado, implicando la conversión del conjunto de caracteres Japanese. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2015-8614. • http://www.openwall.com/lists/oss-security/2015/12/31/1 https://security.gentoo.org/glsa/201606-11 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-8614
https://notcve.org/view.php?id=CVE-2015-8614
Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion. Múltiples desbordamientos de buffer basado en pila en las funciones (1) conv_jistoeuc, (2) conv_euctojis y (3) conv_sjistoeuc en codeconv.c en Claws Mail en versiones anteriores a 3.13.1 permiten a atacantes remotos tener un impacto no especificado a través de un correo electrónico manipulado, implicando la conversión del conjunto de caracteres Japanese. • http://git.claws-mail.org/?p=claws.git%3Ba=commit%3Bh=d390fa07f5548f3173dd9cc13b233db5ce934c82 http://lists.opensuse.org/opensuse-updates/2016-01/msg00000.html http://www.claws-mail.org/news.php http://www.debian.org/security/2016/dsa-3452 http://www.openwall.com/lists/oss-security/2015/12/21/10 http://www.openwall.com/lists/oss-security/2015/12/22/2 http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3557 https://security.gentoo.org/glsa/201606-11 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-2576
https://notcve.org/view.php?id=CVE-2014-2576
plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks. plugins/rssyl/feed.c en Claws Mail anterior a 3.10.0 deshabilita el check CURLOPT_SSL_VERYHOST para un los campos de nombre de anfitrión en CN o SAN, lo cual facilita a atacantes remotos la suplantación de servidores y la ejecución de ataques man-in-the-middle (MITM). • http://lists.opensuse.org/opensuse-updates/2014-10/msg00015.html http://seclists.org/oss-sec/2014/q1/636 http://secunia.com/advisories/60422 http://sourceforge.net/p/claws-mail/news/2014/05/claws-mail-3100-unleashed http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3106 • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 5%CPEs: 1EXPL: 0CVE-2012-4507
https://notcve.org/view.php?id=CVE-2012-4507
The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted email. La función strchr en procmime.c en Claws Mail (alias claws-mail) v3.8.1 permite a atacantes remotos provocar una denegación de servicio (desreferencia de puntero NULL y caída) mediante un correo electrónico modificado. • http://lists.opensuse.org/opensuse-updates/2012-10/msg00064.html http://www.openwall.com/lists/oss-security/2012/10/09/1 http://www.openwall.com/lists/oss-security/2012/10/09/3 http://www.openwall.com/lists/oss-security/2012/10/10/3 http://www.securityfocus.com/bid/55837 http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=2743 https://bugzilla.redhat.com/show_bug.cgi?id=862578 •
CVSS: 3.6EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6208
https://notcve.org/view.php?id=CVE-2007-6208
sylprint.pl in claws mail tools (claws-mail-tools) allows local users to overwrite arbitrary files via a symlink attack on the sylprint.[USER].[PID] temporary file. sylprint.pl de claws mail tools (claws-mail-tools) permite a usuarios locales sobrescribir ficheros de su elección mediante un ataque de enlaces simbólicos en el fichero temporal sylprint.[USER].[PID] • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=454089 http://osvdb.org/42478 http://secunia.com/advisories/27897 http://secunia.com/advisories/28402 http://security.gentoo.org/glsa/glsa-200801-03.xml http://www.securityfocus.com/bid/26676 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •