claws-mail -- POP3 Format String Vulnerability

2007-08-2400:00:00

vuxml.freebsd.org

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.026 Low

EPSS

Percentile

90.3%

JSON

A Secunia Advisory reports:

A format string error in the “inc_put_error()” function in
src/inc.c when displaying a POP3 server’s error response can
be exploited via specially crafted POP3 server replies containing
format specifiers.
Successful exploitation may allow execution of arbitrary code,
but requires that the user is tricked into connecting to a malicious
POP3 server.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchclaws-mail< 2.10.0_3UNKNOWN
FreeBSDanynoarchsylpheed-claws< 2.10.0_3UNKNOWN
FreeBSDanynoarchsylpheed2< 2.4.4_1UNKNOWN