CVE-2020-16118: Null Pointer Dereference
In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by sending a PREAUTH response to imapmboxconnect in libbalsa/imap/imap-handle.c.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-16118?
CVE-2020-16118 is a vulnerability in GNOME Balsa before version 2.6.0 that allows a malicious server operator or man-in-the-middle to trigger a NULL pointer dereference and crash the client.
How can a malicious server operator or man-in-the-middle exploit CVE-2020-16118?
A malicious server operator or man-in-the-middle can exploit CVE-2020-16118 by sending a PREAUTH response to imap_mbox_connect in libbalsa/imap/imap-handle.c.
What is the severity of CVE-2020-16118?
CVE-2020-16118 has a severity rating of 7.5 (high).
Which software versions are affected by CVE-2020-16118?
GNOME Balsa versions before 2.6.0, openSUSE Backports SLE 15.0-sp1, and openSUSE Leap 15.1 are affected by CVE-2020-16118.
How can I fix CVE-2020-16118?
To fix CVE-2020-16118, it is recommended to update to GNOME Balsa version 2.6.0 or later.