CVE-2017-17689

CVE-2017-17689 arises from S/MIME CBC gadget attacks (EFAIL) that can lead to plaintext exfiltration. Connected sources show this affecting KDE PIM/KMail components and related mail tooling across Linux/macOS ecosystems, with public advisories describing how S/MIME/CBC malleability could leak pla...

CVE-2001-0398

The BAT! mail client is affected by CVE-2001-0398. An attachment whose file name contains many spaces can bypass the user warning for executable attachments and allow remote attackers to execute arbitrary commands, while also causing the client to misrepresent the attachment’s type with a differe...

CVE-2001-0676

CVE-2001-0676 affects Rit Research Labs The Bat!

CVE-2006-0630

The CVE-2006-0630 issue affects RITLabs The Bat! before 3.0.0.15, where certain headers from encapsulated data in message/partial MIME messages are shown instead of the real headers, violating RFC2046 header merging. This enables remote attackers to spoof the email origin by sending a fragmented ...

CVE-2001-0675

The Bat! (RIT Research Labs) for Windows (The Bat! v1.51) is affected by a vulnerability where a remote attacker can trigger a denial of service by delivering an email containing a carriage return CR not followed by a LF. This incorrect RFC822 parsing can cause premature end-of-message handling, ...

CVE-2003-1133

CVE-2003-1133 affects Rit Research Labs The Bat! versions 1.0.11–2.0. The root cause is insecure ACLs used when creating new accounts, allowing local attackers to read other users’ email messages. The vulnerability is local and limited by the product’s access controls. KB/related advisories from ...

CVE-2006-0918

The CVE-2006-0918 entry concerns a buffer overflow in The Bat! client from RITLabs, specifically The Bat! 3.60.07. The vulnerability occurs via a long Subject field, enabling remote attackers to potentially execute arbitrary code. The connected sources confirm the affected product/version and the...

CVE-2002-0338

The CVE-2002-0338 issue affects The Bat! mail client, specifically version 1.53d and 1.54beta (and possibly others). A remote attacker can trigger a denial of service (crash) by sending an attachment whose filename includes an MS-DOS device name. The available references confirm the consequence a...