CVE-2020-15953

LibEtPan ≤ 1.9.4 (used in MailCore 2 ≤ 0.6.3 and related products) contains a STARTTLS buffering issue that enables response injection during TLS negotiation across IMAP, SMTP, and POP3. The root cause is improper handling when a server responds with begin TLS, causing the client to read extra da...

CVE-2020-15953

LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a meddler-in-the-middle attacker and evaluates it in a TLS...

CVE-2020-15953

LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a meddler-in-the-middle attacker and evaluates it in a TLS...

PT-2020-14734 · Unknown +4 · Mailcore 2 +4

Name of the Vulnerable Software and Affected Versions: LibEtPan versions 1.9.4 and earlier MailCore 2 versions 0.6.3 and earlier Description: The issue affects IMAP, SMTP, and POP3 protocols due to a STARTTLS buffering problem. When a server sends a "begin TLS" response, the client reads addition...

Null Pointer Dereference

libetpan is vulnerable to null pointer dereference. The vulnerability is possible because of a flaw in handling of MIME...

openSUSE Security Update : libetpan (openSUSE-2018-41)

This update for libetpan fixes the following issues : - CVE-2017-8825: Segmentation faults in mime handling were fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2018-41. The te...

Updated libetpan packages fix security vulnerability

It was discovered that libetpan, a C language mail access and handling library that is used in a number of MUAs, contained a NULL dereference vulnerability in the MIME handling code CVE-2017-8825...

MGASA-2017-0191 Updated libetpan packages fix security vulnerability

It was discovered that libetpan, a C language mail access and handling library that is used in a number of MUAs, contained a NULL dereference vulnerability in the MIME handling code CVE-2017-8825...

MailCore and MailCore 2 Denial of Service Vulnerabilities

MailCore is a framework developed and maintained by the MailCore team for handling the email protocols IMAP and SMTP.MailCore2 is the next generation of MailCore.LibEtPan is one of the mail libraries providing support for different types of mail access.MIMEhandlingcomponent is one of the...

FreeBSD : libetpan -- null dereference vulnerability in MIME parsing component (57600032-34fe-11e7-8965-bcaec524bf84)

rwhitworth reports : I was using American Fuzzy Lop afl-fuzz to fuzz input to the mime-parse test program. Is fixing these crashes something you're interested in? The input files can be found here : https://github.com/rwhitworth/libetpan-fuzz/. The files can be executed as ./mime-parse idfilename...

Design/Logic Flaw

A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses...

CVE-2017-8825

A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses...

CVE-2017-8825

A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses...

UBUNTU-CVE-2017-8825

A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses...

DEBIAN-CVE-2017-8825

A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses...

CVE-2017-8825

A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses...

CVE-2017-8825

CVE-2017-8825 affects LibEtPan’s MIME handling (used by MailCore/MailCore 2). The vulnerability is a NULL dereference in the MIME parser (low-level/imf/mailimf.c) when parsing a Cc header with multiple addresses on pre-1.8 releases, resulting in a crash. A fix is available in LibEtPan 1.8 and lat...

CVE-2017-8825

A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses...

CVE-2017-8825

A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses...

libetpan -- null dereference vulnerability in MIME parsing component

rwhitworth reports: I was using American Fuzzy Lop afl-fuzz to fuzz input to the mime-parse test program. Is fixing these crashes something you're interested in? The input files can be found here: https://github.com/rwhitworth/libetpan-fuzz/. The files can be executed as ./mime-parse idfilename t...