CVE-2006-2920: Sylpheed-Claws before 2.2.2 and Sylpheed before 2.2.6 allow remote attackers to bypass the URI check functiona

Q: How do I fix CVE-2006-2920?

sylpheed: upgrade to newer than 2.2.5; sylpheed-claws: upgrade to newer than 2.2.1. Exact commands for each OS are on this page.

Q: Is CVE-2006-2920 being exploited?

CVE-2006-2920 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2006-2920 affect?

CVE-2006-2920 affects sylpheed, sylpheed-claws. Severity is low (CVSS 2.6). Sylpheed-Claws before 2.2.2 and Sylpheed before 2.2.6 allow remote attackers to bypass the URI check functionality and makes it easier to conduct phishing attacks via a URI that begins with a space character.

Q: How urgent is CVE-2006-2920?

Priority 32/100. On your watchlist

Routine

LOW 2.6WATCHLISTUPGRADEUPGRADE

CVE-2006-2920 is a low-severity flaw (CVSS 2.6) affecting sylpheed, sylpheed-claws. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Sylpheed-Claws before 2.2.2 and Sylpheed before 2.2.6 allow remote attackers to bypass the URI check functionality and makes it easier to conduct phishing attacks via a URI that begins with a space character.

Why this priority

On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	2.6 (Low)
EPSS exploit chance	1.4% (top 27%)
CISA exploited list	No
Weakness	CWE-20
Published	2006-06-09
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: sylpheed · sylpheed-claws

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2006-06-09 01:02 UTCPublished CVE record published
2026-06-16 22:26 UTCUpdated Record last modified

sylpheed sylpheed UPGRADE

Affected: <= 2.2.5 · 2.0 · 2.0.1 · 2.0.2 · 2.0.3 · 2.1 · 2.1.1 · 2.1.2

Fixed in: newer than 2.2.5

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy sylpheed || rpm -q sylpheed || sylpheed --version

2. UPGRADE to newer than 2.2.5 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade sylpheed

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade sylpheed

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

sylpheed-claws sylpheed-claws UPGRADE

Affected: <= 2.2.1 · 0.9.4 · 0.9.5 · 0.9.6 · 1.0.2

Fixed in: newer than 2.2.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy sylpheed-claws || rpm -q sylpheed-claws || sylpheed-claws --version

2. UPGRADE to newer than 2.2.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade sylpheed-claws

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade sylpheed-claws

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2006-2920?

sylpheed: upgrade to newer than 2.2.5; sylpheed-claws: upgrade to newer than 2.2.1. Exact commands for each OS are on this page.

Is CVE-2006-2920 being exploited?

CVE-2006-2920 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2006-2920 affect?

CVE-2006-2920 affects sylpheed, sylpheed-claws. Severity is low (CVSS 2.6). Sylpheed-Claws before 2.2.2 and Sylpheed before 2.2.6 allow remote attackers to bypass the URI check functionality and makes it easier to conduct phishing attacks via a URI that begins with a space character.

How urgent is CVE-2006-2920?

Priority 32/100. On your watchlist

Related CVEs

CVE-2021-37746 MEDIUM 6.1 UPGRADE UPGRADE textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not ha
CVE-2017-17517 HIGH 8.8 UPGRADE libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by t
CVE-2007-2958 MEDIUM 6.8 DOWNGRADE DOWNGRADE Format string vulnerability in the inc_put_error function in src/inc.c in Sylpheed 2.4.4, and Sylpheed-Claws (
CVE-2007-1267 MEDIUM 5.0 UPGRADE Sylpheed 2.2.7 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents
CVE-2005-3354 MEDIUM 5.1 DOWNGRADE Stack-based buffer overflow in the ldif_get_line function in ldif.c of Sylpheed before 2.1.6 allows user-assis

References

← Back to latest CVEs