CVE-2014-2576: Medium severity mambo cms vulnerability
Published Oct 15, 2014
·Updated
plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPTSSLVERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.
Affected Software
3 affected components
claws-mail claws-mail<=3.9.3
openSUSE openSUSE=12.3
openSUSE openSUSE=13.1
Event History
Oct 15, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-2576?
CVE-2014-2576 is considered a medium severity vulnerability due to its potential for enabling man-in-the-middle attacks.
2
How do I fix CVE-2014-2576?
To fix CVE-2014-2576, upgrade Claws Mail to version 3.10.0 or later, where the vulnerability has been patched.
3
What versions of Claws Mail are affected by CVE-2014-2576?
CVE-2014-2576 affects all versions of Claws Mail prior to 3.10.0.
4
What type of attacks can CVE-2014-2576 facilitate?
CVE-2014-2576 can facilitate man-in-the-middle (MITM) attacks due to the disabled SSL host verification.
5
Which operating systems are impacted by CVE-2014-2576?
CVE-2014-2576 impacts openSUSE versions 12.3 and 13.1 when using the affected Claws Mail versions.