CVE-2020-16094: High severity claws-mail claws-mail vulnerability
In imapscantreerecursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursion into subdirectories during a rebuild of the folder tree.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/claws-mailto a version that resolves this vulnerability.Fixed in 3.17.7-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2020-16094?
CVE-2020-16094 has been classified with a high severity rating due to the potential for denial of service through stack consumption.
How do I fix CVE-2020-16094?
To mitigate CVE-2020-16094, update Claws Mail to version 3.17.7 or later, which addresses the vulnerability.
Which versions of Claws Mail are affected by CVE-2020-16094?
CVE-2020-16094 affects Claws Mail versions up to and including 3.17.6.
What types of systems are vulnerable to CVE-2020-16094?
CVE-2020-16094 affects Claws Mail on various Linux distributions, including Fedora 31, 32, and 33.
What causes CVE-2020-16094?
CVE-2020-16094 is caused by unchecked recursion into subdirectories during the rebuilding of the folder tree in Claws Mail.