[SECURITY] [DSA 3452-1] claws-mail security update

2016-01-2306:30:58

lists.debian.org

0.006 Low

EPSS

Percentile

78.2%

JSON

Debian Security Advisory DSA-3452-1 [email protected]
https://www.debian.org/security/ Ben Hutchings
January 23, 2016 https://www.debian.org/security/faq

Package : claws-mail
CVE ID : CVE-2015-8614

"DrWhax" of the Tails project reported that Claws Mail is missing
range checks in some text conversion functions. A remote attacker
could exploit this to run arbitrary code under the account of a user
that receives a message from them using Claws Mail.

For the oldstable distribution (wheezy), this problem has been fixed
in version 3.8.1-2+deb7u1.

For the stable distribution (jessie), this problem has been fixed in
version 3.11.1-3+deb8u1.

We recommend that you upgrade your claws-mail packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian8arm64claws-mail-bsfilter-plugin< 3.11.1-3+deb8u1claws-mail-bsfilter-plugin_3.11.1-3+deb8u1_arm64.deb
Debian7sparcclaws-mail-smime-plugin< 3.8.1-2+deb7u1claws-mail-smime-plugin_3.8.1-2+deb7u1_sparc.deb
Debian7sparcclaws-mail-spamassassin< 3.8.1-2+deb7u1claws-mail-spamassassin_3.8.1-2+deb7u1_sparc.deb
Debian8kfreebsd-i386claws-mail-attach-warner< 3.11.1-3+deb8u1claws-mail-attach-warner_3.11.1-3+deb8u1_kfreebsd-i386.deb
Debian8kfreebsd-i386claws-mail-gdata-plugin< 3.11.1-3+deb8u1claws-mail-gdata-plugin_3.11.1-3+deb8u1_kfreebsd-i386.deb
Debian8ppc64ellibclaws-mail-dev< 3.11.1-3+deb8u1libclaws-mail-dev_3.11.1-3+deb8u1_ppc64el.deb
Debian8s390xclaws-mail-mailmbox-plugin< 3.11.1-3+deb8u1claws-mail-mailmbox-plugin_3.11.1-3+deb8u1_s390x.deb
Debian6i386claws-mail< 3.7.6-4+squeeze2claws-mail_3.7.6-4+squeeze2_i386.deb
Debian8armelclaws-mail-attach-warner< 3.11.1-3+deb8u1claws-mail-attach-warner_3.11.1-3+deb8u1_armel.deb
Debian8powerpcclaws-mail-pdf-viewer< 3.11.1-3+deb8u1claws-mail-pdf-viewer_3.11.1-3+deb8u1_powerpc.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	arm64	claws-mail-bsfilter-plugin	< 3.11.1-3+deb8u1	claws-mail-bsfilter-plugin_3.11.1-3+deb8u1_arm64.deb
Debian	7	sparc	claws-mail-smime-plugin	< 3.8.1-2+deb7u1	claws-mail-smime-plugin_3.8.1-2+deb7u1_sparc.deb
Debian	7	sparc	claws-mail-spamassassin	< 3.8.1-2+deb7u1	claws-mail-spamassassin_3.8.1-2+deb7u1_sparc.deb
Debian	8	kfreebsd-i386	claws-mail-attach-warner	< 3.11.1-3+deb8u1	claws-mail-attach-warner_3.11.1-3+deb8u1_kfreebsd-i386.deb
Debian	8	kfreebsd-i386	claws-mail-gdata-plugin	< 3.11.1-3+deb8u1	claws-mail-gdata-plugin_3.11.1-3+deb8u1_kfreebsd-i386.deb
Debian	8	ppc64el	libclaws-mail-dev	< 3.11.1-3+deb8u1	libclaws-mail-dev_3.11.1-3+deb8u1_ppc64el.deb
Debian	8	s390x	claws-mail-mailmbox-plugin	< 3.11.1-3+deb8u1	claws-mail-mailmbox-plugin_3.11.1-3+deb8u1_s390x.deb
Debian	6	i386	claws-mail	< 3.7.6-4+squeeze2	claws-mail_3.7.6-4+squeeze2_i386.deb
Debian	8	armel	claws-mail-attach-warner	< 3.11.1-3+deb8u1	claws-mail-attach-warner_3.11.1-3+deb8u1_armel.deb
Debian	8	powerpc	claws-mail-pdf-viewer	< 3.11.1-3+deb8u1	claws-mail-pdf-viewer_3.11.1-3+deb8u1_powerpc.deb