PatchTheCVEclaws-mail vulnerabilities
Recent CVEs affecting claws-mail products. 9 tracked.
claws-mail has 9 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2021-07-30. Highest priority: CVE-2020-15917 (score 66/100).
- CVE-2021-37746 MEDIUM 6.1 UPGRADE UPGRADE textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not ha
- CVE-2020-16094 HIGH 7.5 UPGRADE MITIGATE In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumptio
- CVE-2020-15917 CRITICAL 9.8 UPGRADE MITIGATE common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mi
- CVE-2019-10735 MEDIUM 4.3 DOWNGRADE In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts w
- CVE-2015-8708 HIGH 7.3 DOWNGRADE Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote att
- CVE-2015-8614 HIGH 7.3 UPGRADE MITIGATE Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc func
- CVE-2014-2576 MEDIUM 6.8 UPGRADE MITIGATE plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host
- CVE-2012-5527 MEDIUM 5.5 MITIGATE Claws Mail vCalendar plugin: credentials exposed on interface
- CVE-2012-4507 MEDIUM 5.0 DOWNGRADE The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 allows remote attackers to cause a deni
FAQ
How do I fix claws-mail vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is claws-mail being exploited right now?
None of the tracked claws-mail CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which claws-mail CVE should I patch first?
CVE-2020-15917 currently ranks highest (66/100): common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mi.