claws-mail: code execution
| Package(s): | claws-mail | CVE #(s): | CVE-2015-8614 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 23, 2015 | Updated: | February 17, 2016 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
A remotely triggerable buffer overflow has been found in the code of claws-mail handling character conversion, in functions conv_jistoeuc(), conv_euctojis() and conv_sjistoeuc(), in codeconv.c. There was no bounds checking on buffers passed to these functions, some stack-based but other potentially heap-based. This issue has been located in the wild and might currently be exploited. A remote attacker might be able to execute arbitrary code on the affected host by sending a crafted e-mail to a claws-mail user. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||