PT-2016-3935 · Claws Mail Team+1 · Claws Mail+1

Kurt Seifried · Publicado 2015-12-21 · Atualizado 2018-10-30 · CVE-2015-8614

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Claws Mail versions prior to 3.13.1

Description The issue involves multiple stack-based buffer overflows in the conv jistoeuc, conv euctojis, and conv sjistoeuc functions in codeconv.c. This allows remote attackers to have an unspecified impact via a crafted email, specifically involving Japanese character set conversion.

Recommendations For versions prior to 3.13.1, update to version 3.13.1 or later to resolve the issue. As a temporary workaround, consider disabling the conv jistoeuc, conv euctojis, and conv sjistoeuc functions until a patch is available. Restrict access to emails that may trigger the Japanese character set conversion to minimize the risk of exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2015-2159

CVE-2015-8614

DLA-383-1

DSA-3452-1

MGASA-2016-0008

OPENSUSE-SU-2024:10428-1

Produtos afetados

Alt Linux

Claws Mail

Referências · 29

• http://debian.org/security/2016/dsa-3452 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8614 · Aviso do Fabricante
• http://git.claws-mail.org/?p=claws.git;a=commit;h=d390fa07f5548f3173dd9cc13b233db5ce934c82 · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-8614 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/12/21/10 · Nota
• https://security.gentoo.org/glsa/201606-11 · Aviso do Fabricante
• http://claws-mail.org/news.php · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/12/22/2 · Nota
• http://git.claws-mail.org/?p=claws.git%3Ba=commit%3Bh=d390fa07f5548f3173dd9cc13b233db5ce934c82 · Nota
• https://osv.dev/vulnerability/MGASA-2016-0008 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=17380 · Nota
• http://thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3584 · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2015-8614 · Nota
• http://lists.opensuse.org/opensuse-updates/2016-01/msg00000.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8614 · Nota de Segurança