Damian Poddebniak

The issue is related to a buffer overflow in memory, which can be exploited by sending several literals in a single command, potentially allowing a remote attacker to cause a denial of service. Authenticated attackers can cause unbounded memory allocation by sending many LITERALs in a single command.

Name of the Vulnerable Software and Affected Versions: SamsungCapture versions prior to 4.8.02 Description: The issue is related to improper file management, which allows for the leak of sensitive information. Recommendations: For versions prior to 4.8.02, update to version 4.8.02 or later to resolve the issue.

The issue is related to Fetchmail's failure to enforce STARTTLS session encryption under certain circumstances, such as with IMAP and PREAUTH.

A S/MIME issue existed in the handling of encrypted email, allowing an attacker to potentially recover plaintext contents of an S/MIME-encrypted email. This issue was addressed by not automatically loading some MIME parts.

Man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS.

The issue is related to the STARTTLS feature in Exim, which allows response injection during MTA SMTP sending. This is due to insufficient neutralization of special elements in the request. The exploitation of this issue may allow a remote attacker to impact data integrity.

The issue is related to insufficient input validation in the Mozilla Thunderbird email client. It can be exploited by a remote attacker in a "man-in-the-middle" (MITM) scenario, allowing the execution of arbitrary code. Specifically, if Thunderbird is configured to use STARTTLS for an IMAP connection and an attacker injects IMAP server responses before the STARTTLS handshake is complete, Thunderbird may display incorrect information, such as non-existent folders on the IMAP server.

The issue is related to the submission service in Dovecot, which allows STARTTLS command injection in lib-smtp. This can lead to sensitive information being redirected to an attacker-controlled address. The vulnerability is also associated with incorrect neutralization of special elements in output used by the incoming component, potentially allowing a remote attacker to disclose user credentials.

The issue is related to errors in privilege management within the Windows HTML Platform component of the Windows operating system. This can allow a remote attacker to bypass existing security restrictions.

An attacker in a privileged network position may be able to misrepresent application state due to a logic issue. This issue was addressed with improved state management.

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 78.7 Description: The issue is related to insufficient input validation during the STARTTLS connection setup, specifically in the plaintext phase. This could allow protocol commands to be injected and evaluated within the encrypted session, potentially affecting the confidentiality and integrity of protected information. Recommendations: For versions prior to 78.7, update to version 78.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the STARTTLS connection setup until a patch is available.

The issue is related to insufficient protection of registration data, which could allow a remote attacker to access confidential data. If an IMAP server's initial server response was invalid, the connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.

This issue was addressed with improved checks. A remote attacker may be able to unexpectedly alter application state.

The SMTP STARTTLS option is not honored in KDE KMail, resulting in cleartext messages being sent unless the "Server requires authentication" option is checked.

Name of the Vulnerable Software and Affected Versions: evolution-data-server versions through 3.36.3 Description: The issue is related to a STARTTLS buffering problem that impacts SMTP and POP3. When a server sends a "begin TLS" response, the software reads additional data and evaluates it in a TLS context, which can lead to "response injection." This could potentially allow a remote attacker to affect data integrity. Recommendations: For evolution-data-server versions through 3.36.3, update to a version that addresses the STARTTLS buffering issue to prevent potential response injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows man-in-the-middle attackers to spoof SMTP servers by ignoring certificate-verification errors in the MSA/SMTP.cpp component.

Name of the Vulnerable Software and Affected Versions: Mutt versions prior to 1.14.4 NeoMutt versions prior to 2020-06-19 Description: The issue is related to a STARTTLS buffering problem that affects IMAP, SMTP, and POP3 protocols. When a server sends a "begin TLS" response, the client reads additional data and evaluates it in a TLS context, which can lead to "response injection." This can potentially allow a remote attacker to gain unauthorized access to protected information. Recommendations: For Mutt versions prior to 1.14.4, update to version 1.14.4 or later. For NeoMutt versions prior to 2020-06-19, update to a version released after 2020-06-19. As a temporary workaround, consider restricting the use of STARTTLS to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Mutt versions prior to 1.14.3 Description: The issue is related to insufficient data protection in the Mutt email client, allowing a remote attacker to perform a man-in-the-middle attack. Specifically, Mutt before version 1.14.3 is vulnerable to an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. Recommendations: For versions prior to 1.14.3, update to version 1.14.3 or later to resolve the issue. As a temporary workaround, consider disabling the IMAP fcc/postpone feature until a patch is available. Restrict access to sensitive email accounts to minimize the risk of exploitation. Avoid using the PREAUTH response in IMAP connections until the issue is resolved.

The issue arises when Thunderbird is configured to use STARTTLS for an IMAP server and the server sends a PREAUTH response. In this scenario, Thunderbird continues with an unencrypted connection, resulting in email data being sent without protection.

The issue allows S/MIME signature spoofing when processing a maliciously crafted mail message.