PatchTheCVEbalsa vulnerabilities and fixes
Recent CVEs affecting balsa, with upgrade or downgrade steps. 5 tracked.
balsa has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2020-07-29. Highest priority: CVE-2020-13645 (score 58/100).
- CVE-2020-16118 HIGH 7.5 UPGRADE DOWNGRADE In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer deref
- CVE-2020-13645 MEDIUM 6.5 UPGRADE UPGRADE In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verificatio
- CVE-2007-5007 MEDIUM 6.8 DOWNGRADE Stack-based buffer overflow in the ir_fetch_seq function in balsa before 2.3.20 might allow remote IMAP server
- CVE-2003-0300 MEDIUM 5.0 DOWNGRADE DOWNGRADE The IMAP Client for Sylpheed 0.8.11 allows remote malicious IMAP servers to cause a denial of service (crash)
- CVE-2003-0299 HIGH 7.5 DOWNGRADE DOWNGRADE The IMAP Client, as used in mutt 1.4.1 and Balsa 2.0.10, allows remote malicious IMAP servers to cause a denia
FAQ
How do I fix balsa vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is balsa being exploited right now?
None of the tracked balsa CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which balsa CVE should I patch first?
CVE-2020-13645 currently ranks highest (58/100): In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verificatio.