PT-2014-4788 · Claws Mail Team+1 · Claws Mail+1

Marcus Meissner · Publicado 2014-05-26 · Atualizado 2018-10-30 · CVE-2014-2576

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Claws Mail versions prior to 3.10.0

Description The issue makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks by disabling the CURLOPT SSL VERIFYHOST check for CN or SAN host name fields in the feed.c plugin.

Recommendations For versions prior to 3.10.0, update to version 3.10.0 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

ALT-PU-2014-1689

CVE-2014-2576

MGASA-2014-0449

Produtos afetados

Alt Linux

Claws Mail

Referências · 17

• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2576 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2014-10/msg00015.html · Aviso do Fabricante
• http://thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3106 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-2576 · Aviso do Fabricante
• http://claws-mail.org/news.php · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2014-2576 · Nota
• https://advisories.mageia.org/MGASA-2014-0449.html · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-2576 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=14281 · Nota
• https://osv.dev/vulnerability/MGASA-2014-0449 · Aviso do Fabricante
• http://secunia.com/advisories/60422 · Nota
• http://seclists.org/oss-sec/2014/q1/636 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2576 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2014-1689 · Aviso do Fabricante
• http://sourceforge.net/p/claws-mail/news · Nota