CVE-2016-10937
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
- Record
CVE-2016-10937- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
- Record
CVE-2016-10937- Updated
- 2026-11-02
EUVDEUVD-2016-1928 No score
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
- Record
EUVD-2016-1928- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-849m-v43m-ppmq
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
- Record
GHSA-849m-v43m-ppmq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
- Record
CVE-2016-10937- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-10937
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
- Record
DEBIAN-CVE-2016-10937- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10937
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
- Record
UBUNTU-CVE-2016-10937- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0673-1 No score
Security update for imapfilter
This update for imapfilter fixes the following issues:
Imapfilter was updated to version 2.6.16 including the following security issue:
- CVE-2016-10937: Added Support for SSL hostname validation (boo#1149931).
- Record
openSUSE-SU-2020:0673-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0765-1 No score
Security update for imapfilter
This update for imapfilter fixes the following issues:
Imapfilter was updated to version 2.6.16 including the following security issue:
- CVE-2016-10937: Added Support for SSL hostname validation (boo#1149931).
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:0765-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imapfilterDebian:12 |
before 1:2.6.13-1 | 1:2.6.13-1 |
imapfilterDebian:13 |
before 1:2.6.13-1 | 1:2.6.13-1 |
imapfilterDebian:14 |
before 1:2.6.13-1 | 1:2.6.13-1 |
imapfilterDebian:8 |
before 1:2.5.2-2+deb8u1, plus listed versions 1:2.5.2-2 |
1:2.5.2-2+deb8u1 |
imapfilterUbuntu:Pro:14.04:LTS |
before 1:2.5.2-2+deb8u1build0.14.04.1~esm1, plus listed versions 1:2.5.2-2 |
1:2.5.2-2+deb8u1build0.14.04.1~esm1 |
imapfilterUbuntu:16.04:LTS |
All versions, plus listed versions 1:2.6.2-11:2.6.2-1ubuntu11:2.6.4-1 |
None known |
imapfilterUbuntu:18.04:LTS |
All versions, plus listed versions 1:2.6.10-11:2.6.11-11:2.6.11-1build1 |
None known |
imapfilteropenSUSE:Leap 15.1 |
before 2.6.16-lp151.3.3.1 | 2.6.16-lp151.3.3.1 |
imapfilterSUSE:Package Hub 15 SP1 |
before 2.6.16-bp151.4.3.1 | 2.6.16-bp151.4.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10937 is a high vulnerability (CVSS 7.5) in Imapfilter Project Imapfilter, published September 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. Fixed in imapfilter 1:2.6.13-1.
References
github.com/lefcha/imapfilter/issues/142
bugs.debian.org/939702
lists.debian.org/debian-lts-announce/2019/10/msg00040.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GBNDFMAIUA6PQMV2P6OKIP7JZQEWX7D2
lists.opensuse.org/opensuse-security-announce/2020-05/msg00042.html
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-10937
security-tracker.debian.org/tracker/CVE-2016-10937
ubuntu.com/security/CVE-2016-10937
cve.org/CVERecord?id=CVE-2016-10937
bugzilla.suse.com/1149931
suse.com/security/cve/CVE-2016-10937