CVE-2016-10727

CRITICAL

Canonical Ubuntu Linux < 3.21.2 - Information Disclosure

Title source: rule
STIX 2.1

Description

camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.

References (5)

Core 5
Core References
Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1334842
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3724-1/

Scores

CVSS v3 9.8
EPSS 0.0102
EPSS Percentile 77.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-200
Status published
Products (3)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
gnome/evolution < 3.21.2
Published Jul 20, 2018
Tracked Since Feb 18, 2026