Damian Poddebniak

**Name of the Vulnerable Software and Affected Versions** Cyrus IMAP versions prior to 3.8.3 Cyrus IMAP versions 3.10.x prior to 3.10.0-rc1 **Description** The issue is related to a buffer overflow in memory, which can be exploited by sending several literals in a single command, potentially allowing a remote attacker to cause a denial of service. Authenticated attackers can cause unbounded memory allocation by sending many LITERALs in a single command. **Recommendations** For Cyrus IMAP versions prior to 3.8.3, update to version 3.8.3 or later. For Cyrus IMAP versions 3.10.x prior to 3.10.0-rc1, update to version 3.10.0-rc1 or later. As a temporary workaround, consider restricting the number of LITERALs that can be sent in a single command to prevent unbounded memory allocation.

Name of the Vulnerable Software and Affected Versions: SamsungCapture versions prior to 4.8.02 Description: The issue is related to improper file management, which allows for the leak of sensitive information. Recommendations: For versions prior to 4.8.02, update to version 4.8.02 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Fetchmail versions prior to 6.4.22 **Description** The issue is related to Fetchmail's failure to enforce STARTTLS session encryption under certain circumstances, such as with IMAP and PREAUTH. **Recommendations** For versions prior to 6.4.22, update to version 6.4.22 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 15.2 iPadOS versions prior to 15.2 **Description** A S/MIME issue existed in the handling of encrypted email, allowing an attacker to potentially recover plaintext contents of an S/MIME-encrypted email. This issue was addressed by not automatically loading some MIME parts. **Recommendations** For iOS versions prior to 15.2, update to iOS 15.2 or later to resolve the issue. For iPadOS versions prior to 15.2, update to iPadOS 15.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** KDE Trojita version 0.7 **Description** Man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS. **Recommendations** For KDE Trojita version 0.7, consider disabling the acceptance of untagged responses from the IMAP server before STARTTLS as a temporary workaround until a patch is available. Restrict access to folder creation functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Exim versions through 4.94.2 **Description** The issue is related to the STARTTLS feature in Exim, which allows response injection during MTA SMTP sending. This is due to insufficient neutralization of special elements in the request. The exploitation of this issue may allow a remote attacker to impact data integrity. **Recommendations** For Exim versions through 4.94.2, update to a version that contains a fix for this issue to prevent response injection during MTA SMTP sending. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 78.12 **Description** The issue is related to insufficient input validation in the Mozilla Thunderbird email client. It can be exploited by a remote attacker in a "man-in-the-middle" (MITM) scenario, allowing the execution of arbitrary code. Specifically, if Thunderbird is configured to use STARTTLS for an IMAP connection and an attacker injects IMAP server responses before the STARTTLS handshake is complete, Thunderbird may display incorrect information, such as non-existent folders on the IMAP server. **Recommendations** For versions prior to 78.12, update to version 78.12 or later to resolve the issue. As a temporary workaround, consider disabling the use of STARTTLS for IMAP connections until a patch is applied. Restrict access to IMAP servers to minimize the risk of exploitation. Avoid using IMAP connections that do not complete the STARTTLS handshake.

**Name of the Vulnerable Software and Affected Versions** Dovecot versions prior to 2.3.15 **Description** The issue is related to the submission service in Dovecot, which allows STARTTLS command injection in lib-smtp. This can lead to sensitive information being redirected to an attacker-controlled address. The vulnerability is also associated with incorrect neutralization of special elements in output used by the incoming component, potentially allowing a remote attacker to disclose user credentials. **Recommendations** For versions prior to 2.3.15, update to version 2.3.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the submission service until a patch is applied. Avoid using the STARTTLS command in lib-smtp until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Windows HTML Platforms (affected versions not specified) **Description** The issue is related to errors in privilege management within the Windows HTML Platform component of the Windows operating system. This can allow a remote attacker to bypass existing security restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Big Sur 11.4 Security Update versions prior to 2021-003 Catalina Security Update versions prior to 2021-004 Mojave **Description** An attacker in a privileged network position may be able to misrepresent application state due to a logic issue. This issue was addressed with improved state management. **Recommendations** For macOS versions prior to Big Sur 11.4, update to macOS Big Sur 11.4 or later. For Security Update versions prior to 2021-003 Catalina, apply Security Update 2021-003 Catalina or later. For Security Update versions prior to 2021-004 Mojave, apply Security Update 2021-004 Mojave or later.

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 78.7 Description: The issue is related to insufficient input validation during the STARTTLS connection setup, specifically in the plaintext phase. This could allow protocol commands to be injected and evaluated within the encrypted session, potentially affecting the confidentiality and integrity of protected information. Recommendations: For versions prior to 78.7, update to version 78.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the STARTTLS connection setup until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mutt versions prior to 2.0.2 NeoMutt versions prior to 2020-11-20 **Description** The issue is related to insufficient protection of registration data, which could allow a remote attacker to access confidential data. If an IMAP server's initial server response was invalid, the connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle. **Recommendations** For Mutt versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue. For NeoMutt versions prior to 2020-11-20, update to a version released after 2020-11-20 to resolve the issue. As a temporary workaround, consider disabling the use of IMAP servers with invalid initial server responses until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** macOS Catalina versions prior to 10.15.7 Security Update 2020-005 High Sierra versions prior to the update Security Update 2020-005 Mojave versions prior to the update **Description** This issue was addressed with improved checks. A remote attacker may be able to unexpectedly alter application state. **Recommendations** For macOS Catalina versions prior to 10.15.7, update to version 10.15.7 to resolve the issue. For Security Update 2020-005 High Sierra, apply the Security Update 2020-005 to resolve the issue. For Security Update 2020-005 Mojave, apply the Security Update 2020-005 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** KDE KMail version 19.12.3 (aka 5.13.3) **Description** The SMTP STARTTLS option is not honored in KDE KMail, resulting in cleartext messages being sent unless the "Server requires authentication" option is checked. **Recommendations** For KDE KMail version 19.12.3 (aka 5.13.3), ensure the "Server requires authentication" option is checked to enforce the use of STARTTLS for SMTP connections. As a temporary workaround, consider configuring the server to always require authentication for SMTP connections until a patch is available.

Name of the Vulnerable Software and Affected Versions: evolution-data-server versions through 3.36.3 Description: The issue is related to a STARTTLS buffering problem that impacts SMTP and POP3. When a server sends a "begin TLS" response, the software reads additional data and evaluates it in a TLS context, which can lead to "response injection." This could potentially allow a remote attacker to affect data integrity. Recommendations: For evolution-data-server versions through 3.36.3, update to a version that addresses the STARTTLS buffering issue to prevent potential response injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trojita versions prior to 0.8 **Description** The issue allows man-in-the-middle attackers to spoof SMTP servers by ignoring certificate-verification errors in the MSA/SMTP.cpp component. **Recommendations** For versions prior to 0.8, update to version 0.8 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Mutt versions prior to 1.14.4 NeoMutt versions prior to 2020-06-19 Description: The issue is related to a STARTTLS buffering problem that affects IMAP, SMTP, and POP3 protocols. When a server sends a "begin TLS" response, the client reads additional data and evaluates it in a TLS context, which can lead to "response injection." This can potentially allow a remote attacker to gain unauthorized access to protected information. Recommendations: For Mutt versions prior to 1.14.4, update to version 1.14.4 or later. For NeoMutt versions prior to 2020-06-19, update to a version released after 2020-06-19. As a temporary workaround, consider restricting the use of STARTTLS to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Mutt versions prior to 1.14.3 Description: The issue is related to insufficient data protection in the Mutt email client, allowing a remote attacker to perform a man-in-the-middle attack. Specifically, Mutt before version 1.14.3 is vulnerable to an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. Recommendations: For versions prior to 1.14.3, update to version 1.14.3 or later to resolve the issue. As a temporary workaround, consider disabling the IMAP fcc/postpone feature until a patch is available. Restrict access to sensitive email accounts to minimize the risk of exploitation. Avoid using the PREAUTH response in IMAP connections until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 68.9.0 **Description** The issue arises when Thunderbird is configured to use STARTTLS for an IMAP server and the server sends a PREAUTH response. In this scenario, Thunderbird continues with an unencrypted connection, resulting in email data being sent without protection. **Recommendations** For versions prior to 68.9.0, update to version 68.9.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of STARTTLS for IMAP servers until a patch is applied. Restrict access to sensitive email data to minimize the risk of exploitation. Avoid using unencrypted connections for email data transfer until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12.2 **Description** The issue allows S/MIME signature spoofing when processing a maliciously crafted mail message. **Recommendations** For iOS versions prior to 12.2, update to iOS 12.2 to resolve the issue.