A vulnerability was discovered in Claws Mail's STARTTLS handling, possibly allowing an integrity/confidentiality compromise.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/claws-mail | * | < 3.17.6 | >= 3.17.6 |
Claws Mail is a GTK based e-mail client.
It was discovered that Claws Mail was not properly handling state within the STARTTLS protocol handshake.
There may be a breach of integrity or confidentiality in connections made using Claws Mail with STARTTLS.
There is no known workaround at this time.
All Claws Mail users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/claws-mail-3.17.6"
Multiple vulnerabilities have been found in claws-mail, particularly in the default SSL implementation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/claws-mail | * | < 3.13.2 | >= 3.13.2 |
Claws Mail is a GTK based e-mail client.
Multiple vulnerabilities have been discovered in claws-mail. Please review the CVE identifiers referenced below for details.
An attacker could possibly intercept communications due to the default implementation of SSL 3.0.
There is no known workaround at this time.
All claws-mail users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/claws-mail-3.13.2"
Claws Mail uses temporary files in an insecure manner, allowing for a symlink attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/claws-mail | * | < 3.0.2-r1 | >= 3.0.2-r1 |
Claws Mail is a GTK based e-mail client.
Nico Golde from Debian reported that the sylprint.pl script that is part of the Claws Mail tools creates temporary files in an insecure manner.
A local attacker could exploit this vulnerability to conduct symlink attacks to overwrite files with the privileges of the user running Claws Mail.
There is no known workaround at this time.
All Claws Mail users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/claws-mail-3.0.2-r1"
A format string error has been discovered in Sylpheed and Claws Mail, potentially leading to the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| mail-client/claws-mail | * | < 3.0.0 | >= 3.0.0 |
| mail-client/sylpheed | * | < 2.4.5 | >= 2.4.5 |
Sylpheed and Claws Mail are two GTK based e-mail clients.
Ulf Harnhammar from Secunia Research discovered a format string error in the inc_put_error() function in file src/inc.c.
A remote attacker could entice a user to connect to a malicious POP server sending specially crafted replies, possibly resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Sylpheed users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/sylpheed-2.4.5"
All Claws Mail users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/claws-mail-3.0.0"