CVE-2020-15917

common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.

common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.

common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled (CVE-2020-15917).

This update for claws-mail fixes the following issues:

• CVE-2020-15917: Fixed an improper handling of suffix data after STARTTLS is mishandled (boo#1174457).

This update for claws-mail fixes the following issues:

• Update to 3.17.6:

• It is now possible to 'Inherit Folder properties and processing rules from parent folder' when creating new folders with the move message and copy message dialogues.
• A Phishing warning is now shown when copying a phishing URL, (in addition to clicking a phishing URL).
• The progress window when importing an mbox file is now more responsive.
• A warning dialogue is shown if the selected privacy system is 'None' and automatic signing amd/or encrypting is enabled.
• Python plugin: pkgconfig is now used to check for python2. This enables the Python plugin (which uses python2) to be built on newer systems which have both python2 and python3.

• CVE-2020-15917: Fixed an improper handling of suffix data after STARTTLS is mishandled (boo#1174457).

This update for claws-mail fixes the following issues:

• Update to 3.17.6:

• It is now possible to 'Inherit Folder properties and processing rules from parent folder' when creating new folders with the move message and copy message dialogues.
• A Phishing warning is now shown when copying a phishing URL, (in addition to clicking a phishing URL).
• The progress window when importing an mbox file is now more responsive.
• A warning dialogue is shown if the selected privacy system is 'None' and automatic signing amd/or encrypting is enabled.
• Python plugin: pkgconfig is now used to check for python2. This enables the Python plugin (which uses python2) to be built on newer systems which have both python2 and python3.

• CVE-2020-15917: Fixed an improper handling of suffix data after STARTTLS is mishandled (boo#1174457).

This update was imported from the openSUSE:Leap:15.2:Update update project.

This update for claws-mail fixes the following issues:

• CVE-2020-15917: Fixed an improper handling of suffix data after STARTTLS is mishandled (boo#1174457).

This update was imported from the openSUSE:Leap:15.1:Update update project.

This update for claws-mail fixes the following issues:

• Additional cleanup of the template handling

claws-mail was updated to 3.17.8 (boo#1177967)

• Shielded template's |program{} and |attach_program{} so that the command-line that is executed does not allow sequencing such as with && || ;, preventing possible execution of nasty, or at least unexpected, commands
• bug fixes: claws#4376
• updated English, French, and Spanish manuals

• Update to 3.17.7

  • Image Viewer: Image attachments, when displayed, are now resized to fit the available width rather than the available height.
  • -d is now an alias to --debug.
  • Libravatar plugin: New styles supported: Robohash and Pagan.
  • SpamAssassin plugin: The 'Maximum size' option now matches SpamAssassin's maximum; it can now handle messages up to 256MB.
  • LiteHTML viewer plugin: The UI is now translatable. Bug fixes:
  • bug 4313, 'Recursion stack overflow with rebuilding folder tree'
  • bug 4372, '[pl_PL] Crash after 'Send later' without recipient and then 'Close''
  • bug 4373, 'attach mailto URI double free'
  • bug 4374, 'insert mailto URI misses checks'
  • bug 4384, 'U+00AD (soft hyphen) changed to space in Subject'
  • bug 4386, 'Allow Sieve config without userid without warning'
  • Add missing SSL settings when cloning accounts.
  • Parsing of command-line arguments.
  • PGP Core plugin: fix segv in address completion with a keyring.
  • Libravatar plugin: fixes to image display.

• Disable python-gtk plugin on suse_version > 1500: still relying on python2, which is EOL.

• Update to 3.17.6:

  • It is now possible to 'Inherit Folder properties and processing rules from parent folder' when creating new folders with the move message and copy message dialogues.
  • A Phishing warning is now shown when copying a phishing URL, (in addition to clicking a phishing URL).
  • The progress window when importing an mbox file is now more responsive.
  • A warning dialogue is shown if the selected privacy system is 'None' and automatic signing amd/or encrypting is enabled.
  • Python plugin: pkgconfig is now used to check for python2. This enables the Python plugin (which uses python2) to be built on newer systems which have both python2 and python3. Bug fixes:
  • bug 3922, 'minimize to tray on startup not working'
  • bug 4220, 'generates files in cache without content'
  • bug 4325, 'Following redirects when retrieving image'
  • bug 4342, 'Import mbox file command doesn't work twice on a row'
  • fix STARTTLS protocol violation
  • fix initial debug line
  • fix fat-fingered crash when v (hiding msgview) is pressed just before c (check signature)
  • fix non-translation of some Templates strings

• Update to 3.17.5

  • Inline Git patches now have colour syntax highlighting The colours of these, and patch attachments, are configurable on the 'Other' tab of the Display/Colors page of the general preferences.
  • The previously hidden preference, 'summary_from_show', is now configurable within the UI, on the 'Message List' tab of the Display/Summaries page of the general preferences, 'Displayed in From column [ ]'.
  • 'Re-edit' has been added to the message context menu when in the Drafts folder.
  • Additional Date header formats are supported:
    • weekday, month, day, hh, mm, ss, year, zone
    • weekday, month, day, hh, mm, ss, year
  • LiteHtml viewer plugin: scrolling with the keyboard has been implemented.
  • The included tools/scripts have been updated:
    • eud2gc.py converted to Python 3
    • tbird2claws.py converted to Python 3
    • tbird2claws.py converted to Python 3
    • google_search.pl has been replaced with ddg_search.pl (that is, duckduckgo.com instead of google.com)
    • fix_date.sh and its documentation have been updated
    • multiwebsearch.pl 'fm' (freshmeat.net) has been removed; 'google' has been replaced by…

This update for claws-mail fixes the following issues:

Update to 3.18.0

• Support for the OAuth2 authorisation protocol has been added for IMAP, POP and SMTP using custom, user-generated client IDs. OAuth2 preferences are found in the Account Preferences on the Receive page (for POP: Authenticate before POP connection, for IMAP: Authentication method); the Send page (SMTP authentication: Authentication method); and on a dedicated OAuth2 page.

• The option 'Save (X-)Face in address book if possible' has been added to the /Message View/Text Options preferences page. Previously the (X-)Face would be saved automatically, therefore this option is turned on by default.

• The Image Viewer has been reworked. New options have been added to /Message View/Image Viewer: when resizing images, either fit the image width or fit the image height to the available space. Fitting the image height is the default. Regardless of this setting, when displaying images inline they will fit the height. When displaying an image, left-clicking the image will toggle between full size and reduced size; right-clicking will toggle between fitting the height and fitting the width.

• When re-editing a saved message, it is now possible to use /Options/Remove References.

• It is now possible to attempt to retrieve a missing GPG key via WKD.

• The man page has been updated.

• Updated translations: Brazilian Portuguese, British English, Catalan, Czech, Danish, Dutch, French, Polish, Romanian, Russian, Slovak, Spanish, Traditional Chinese, Turkish.

• bug fixes: claws#2411, claws#4326, claws#4394, claws#4431, claws#4445, claws#4447, claws#4455, claws#4473

  • stop WM's X button from causing GPG key fetch attempt
  • Make fancy respect default font size for messageview
  • harden link checker before accepting click
  • non-display of (X-)Face when prefs_common.enable_avatars is AVATARS_ENABLE_RENDER (2)
  • debian bug #983778, 'Segfault on selecting empty 'X-Face' custom header'

• It is now possible to 'Inherit Folder properties and processing rules from parent folder' when creating new folders with the move message and copy message dialogues.

• A Phishing warning is now shown when copying a phishing URL, (in addition to clicking a phishing URL).

• The progress window when importing an mbox file is now more responsive.

• A warning dialogue is shown if the selected privacy system is 'None' and automatic signing amd/or encrypting is enabled.

• Python plugin: pkgconfig is now used to check for python2. This enables the Python plugin (which uses python2) to be built on newer systems which have both python2 and python3.

Bug fixes:

• bug 3922, 'minimize to tray on startup not working'
• bug 4220, 'generates files in cache without content'
• bug 4325, 'Following redirects when retrieving image'
• bug 4342, 'Import mbox file command doesn't work twice on a row'
• fix STARTTLS protocol violation CVE-2020-15917 boo#1174457)
• fix initial debug line
• fix fat-fingered crash when v (hiding msgview) is pressed just before c (check signature)
• fix non-translation of some Templates strings

These are all security issues fixed in the claws-mail-4.0.0-2.5 package on the GA media of openSUSE Tumbleweed.