Description
Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.
References (8)
Core 8
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www.claws-mail.org/news.php
Issue Tracking vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201606-11
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/12/22/2
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-01/msg00000.html
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2016/dsa-3452
Issue Tracking x_refsource_confirm
http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3557
Various Sources x_refsource_confirm
http://git.claws-mail.org/?p=claws.git%3Ba=commit%3Bh=d390fa07f5548f3173dd9cc13b233db5ce934c82
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/12/21/10
Scores
CVSS v3
7.3
EPSS
0.0187
EPSS Percentile
83.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-119
Status
published
Products (4)
claws-mail/claws-mail
< 3.13.0
opensuse/leap
42.1
opensuse/opensuse
13.1
opensuse/opensuse
13.2
Published
Apr 11, 2016
Tracked Since
Feb 18, 2026