Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8614.

The remote host is affected by the vulnerability described in GLSA-201606-11 (claws-mail: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in claws-mail. Please       review the CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly intercept communications due to the default       implementation of SSL 3.0.
  Workaround :

    There is no known workaround at this time.

Update from 3.13.1 to 3.13.2 for bug-fixes. Includes security fix for CVE-2015-8708.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

'DrWhax' of the Tails project reported that Claws Mail is missing range checks in some text conversion functions. A remote attacker could exploit this to run arbitrary code under the account of a user that receives a message from them using Claws Mail.

CVE-2015-8614

There were no checks on the output length for conversions between JIS (ISO-2022-JP) and EUC-JP, between JIS and UTF-8, and from Shift_JIS to EUC-JP.

CVE-2015-8708

The original fix for CVE-2015-8614 was incomplete.

For the oldoldstable distribution (squeeze), these problems have been fixed in version 3.7.6-4+squeeze2.

For the oldstable distribution (wheezy) and the stable distribution (jessie), this will be fixed soon. These versions were built with hardening features that make this issue harder to exploit.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
91842	GLSA-201606-11 : claws-mail: Multiple Vulnerabilities (POODLE)	Nessus	Gentoo Local Security Checks	high
89597	Fedora 22 : claws-mail-3.13.2-1.fc22 (2016-b211281b8e)	Nessus	Fedora Local Security Checks	high
89506	Fedora 23 : claws-mail-3.13.2-1.fc23 (2016-2ec7f779f2)	Nessus	Fedora Local Security Checks	high
87884	Debian DLA-383-1 : claws-mail security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-8708

high

Tenable Plugins

high

high

high

high