CVE-2012-4507: Null Pointer Dereference
Description of problem: A specific mail in the user mbox file cause claws-mail to crash reliabily.
Version-Release number of selected component: claws-mail-3.8.1-1.fc17
Additional info: libreport version: 2.0.14 abrtversion: 2.0.13 backtracerating: 4 cmdline: claws-mail crashfunction: strchr kernel: 3.5.4-2.fc17.x8664
truncated backtrace: :Thread no. 1 (10 frames) : #0 strchr at ../sysdeps/x8664/strchr.S:33 : #1 parseparameters at procmime.c:1756 : #2 procmimeparsecontentdisposition at procmime.c:1842 : #3 procmimeparsemimepart at procmime.c:1967 : #4 procmimeparsemultipart at procmime.c:1566 : #5 procmimeparsemimepart at procmime.c:1994 : #6 procmimeparsemessagerfc822 at procmime.c:1393 : #7 procmimescanfilewithoffset at procmime.c:2058 : #8 procmimescanfilefull at procmime.c:2071 : #9 procmimescanfile at procmime.c:2078
Other sources
The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted email.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4507?
CVE-2012-4507 is considered a moderate severity vulnerability due to its ability to reliably crash the Claws Mail application.
How does CVE-2012-4507 affect Claws Mail?
CVE-2012-4507 affects Claws Mail version 3.8.1, causing it to crash when processing a specific mail in the user mbox file.
How do I fix CVE-2012-4507?
To fix CVE-2012-4507, upgrade Claws Mail to a version that addresses this vulnerability.
What is the version of Claws Mail affected by CVE-2012-4507?
CVE-2012-4507 specifically affects Claws Mail version 3.8.1.
Can CVE-2012-4507 be exploited remotely?
CVE-2012-4507 requires the targeted email to be present in the user’s mbox file, making it not directly exploitable remotely.