Code execution via Eudora

Using META REFRESH it's possible to launch mhtml file...

REFRESH: EUDORA MAIL 5.1.1

Tuesday, July 23, 2002 Trivial silent delivery and installation of an executable on a target computer. This can be accomplished with the default installation of the mail client Eudora 5.1.1: 'allow executables in HTML content' DISABLED 'use Microsoft viewer' ENABLED The manufacturer...

CVE-2002-0456

CVE-2002-0456 affects Eudora 5.1 and earlier. The issue arises because attachments are stored in a directory with a fixed name, which could enable attackers to exploit vulnerabilities in other software that rely on installing/reading files from directories with known pathnames. The provided docum...

CVE-2002-0456

Eudora 5.1 and earlier versions stores attachments in a directory with a fixed name, which could make it easier for attackers to exploit vulnerabilities in other software that rely on installing and reading files from directories with known pathnames...

EUVD-2001-1299

Vulnerabilities in Qualcomm Eudora WorldMail Server may allow remote attackers to cause a denial of service crash and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite...

CVE-2001-1326

Eudora 5.1 allows remote attackers to execute arbitrary code when the "Use Microsoft Viewer" option is enabled and the "allow executables in HTML content" option is disabled, via an HTML email with a form that is activated from an image that the attacker spoofs as a link, which causes the user to...

CVE-2001-1318

The CVE-2001-1318 issue affects Qualcomm Eudora WorldMail Server. Vulnerabilities in the LDAP handling code may allow remote attackers to cause a denial-of-service crash and potentially execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite. Affected component: LDAP service in Wo...

CVE-2001-1326

CVE-2001-1326 affects Eudora 5.1, where remote code execution is possible when the "Use Microsoft Viewer" option is on and the "allow executables in HTML content" option is off. An HTML email containing a form activated from an image spoofed as a link causes the user to execute the form and acces...

CVE-2001-1318

Vulnerabilities in Qualcomm Eudora WorldMail Server may allow remote attackers to cause a denial of service crash and possibly execute arbitrary code, as demonstrated by the PROTOS LDAPv3 test suite...

Code execution via Eudora attachments

It's possible to launch executable attached to e-mail message by specifying it as image source...

CVE-2001-0677

Eudora 5.0.2 is affected. A remote attacker can read arbitrary files by crafting an email whose Attachment Converted MIME header contains the path to a target file; when the user forwards the message, the file is sent to the attacker. Root cause involves improper handling of the Attachment Conver...

CVE-2001-0365

Eudora before 5.1 allows a remote attacker to execute arbitrary code, when the 'Use Microsoft Viewer' and 'allow executables in HTML content' options are enabled, via an HTML email message containing Javascript, with ActiveX controls and malicious code within IMG tags...

CVE-2001-0365

In the provided records, CVE-2001-0365 affects Eudora before 5.1. The vulnerability arises when the email client is configured with “Use Microsoft Viewer” and “allow executables in HTML content” enabled, allowing a remote attacker to execute arbitrary code via an HTML email containing Javascript ...

CVE-2001-0677

Eudora 5.0.2 allows a remote attacker to read arbitrary files via an email with the path of the target file in the "Attachment Converted" MIME header, which sends the file when the email is forwarded to the attacker by the user...

CVE-2001-0677

Eudora 5.0.2 allows a remote attacker to read arbitrary files via an email with the path of the target file in the "Attachment Converted" MIME header, which sends the file when the email is forwarded to the attacker by the user...

CVE-1999-1448

Eudora and Eudora Light before 3.05 allows remote attackers to cause a crash and corrupt the user's mailbox via an e-mail message with certain dates, such as 1 dates before 1970, which cause a Divide By Zero error, or 2 dates that are 100 years after the current date, which causes a segmentation...

CVE-1999-1016

Microsoft HTML control as used in 1 Internet Explorer 5.0, 2 FrontPage Express, 3 Outlook Express 5, and 4 Eudora, and possibly others, allows remote malicious web site or HTML emails to cause a denial of service 100% CPU consumption via large HTML form fields such as text inputs in a table cell...

CVE-1999-1113

Buffer overflow in Eudora Internet Mail Server EIMS 2.01 and earlier on MacOS systems allows remote attackers to cause a denial of service via a long USER command to port 106...

CVE-1999-1448

Affected software: Eudora and Eudora Light before 3.05. Vulnerable component: e-mail processing using dates in messages. Root cause: certain dates cause Divide By Zero errors (dates before 1970) or segmentation faults (dates ~100 years after current date). Impact: remote attacker could cause a cr...

CVE-1999-1113

Affected software: Eudora Internet Mail Server (EIMS) for Mac OS, 2.01 and earlier (pop3/poppassd service). Vuln: buffer overflow in the poppassd USER handling (long USER after USER command on port 106) allows remote disruption of service; OpenVAS notes potential remote code execution, Nessus con...