CVE-2021-37746

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0...

6.1 MediumFix available

CVE-2021-37746 is a medium vulnerability (CVSS 6.1) in Sylpheed Project Sylpheed, published July 30, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in claws-mail 3.18.0-1.

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.16%Up 0.3 points since Jul 31, 2021

What each source reports

NVD Score used 6.1

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.

Record: CVE-2021-37746
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness: CWE-601
Updated: 2026-11-02

CVE List No score

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.

Record: CVE-2021-37746
Updated: 2026-11-02

EUVDEUVD-2021-24227 No score

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.

Record: EUVD-2021-24227
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7cx5-4rpx-pcm3 No score

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0...

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.

Record: GHSA-7cx5-4rpx-pcm3
Weakness: CWE-601
Updated: 2026-11-02

OSV 6.1

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.

Record: CVE-2021-37746
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-37746 6.1

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.

Record: DEBIAN-CVE-2021-37746
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-37746 6.1

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.

Record: UBUNTU-CVE-2021-37746
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVMGASA-2021-0408 No score

Updated sylpheed and claws-mail packages fix security vulnerability

Updated sylpheed and claws-mail packages fix security vulnerability:

The textview_uri_security_check() function in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click (CVE-2021-37746).

Record: MGASA-2021-0408
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`claws-mail` Debian:12	before 3.18.0-1	3.18.0-1
`claws-mail` Debian:13	before 3.18.0-1	3.18.0-1
`claws-mail` Debian:14	before 3.18.0-1	3.18.0-1
`sylpheed` Debian:12	before 3.8.0~beta1-1+deb12u1, plus listed versions 3.8.0~beta1-1	3.8.0~beta1-1+deb12u1
`sylpheed` Debian:13	before 3.8.0~beta1-2+deb13u1, plus listed versions 3.8.0~beta1-2	3.8.0~beta1-2+deb13u1
`claws-mail` Mageia:8	before 3.18.0-1.mga8	3.18.0-1.mga8
`sylpheed` Mageia:8	before 3.7.0-4.1.mga8	3.7.0-4.1.mga8
`claws-mail` Ubuntu:16.04:LTS	All versions, plus listed versions 3.12.0-1ubuntu13.12.0-1ubuntu23.13.1-1.1ubuntu13.13.1-1.1ubuntu23.13.1-1.1ubuntu33.13.2-1ubuntu1	None known
`sylpheed` Ubuntu:16.04:LTS	All versions, plus listed versions 3.4.2-0ubuntu13.5.0~rc2-1ubuntu1	None known
`claws-mail` Ubuntu:18.04:LTS	All versions, plus listed versions 3.15.0-2build23.15.1-13.15.1-1ubuntu13.16.0-1	None known

Show 11 moreShow less

Affected packages
Package	Affected	Fixed
`sylpheed` Ubuntu:18.04:LTS	All versions, plus listed versions 3.5.1-1ubuntu23.5.1-1ubuntu33.5.1-1ubuntu3.18.04.1	None known
`claws-mail` Ubuntu:20.04:LTS	All versions, plus listed versions 3.17.4-13.17.4-1build13.17.4-2build23.17.4-2ubuntu13.17.5-2	None known
`sylpheed` Ubuntu:20.04:LTS	All versions, plus listed versions 3.5.1-1ubuntu53.7.0-6ubuntu1	None known
`claws-mail` Ubuntu:22.04:LTS	All versions, plus listed versions 3.17.8-1build23.18.0-14.0.0-24.0.0-2build14.0.0-3	None known
`sylpheed` Ubuntu:22.04:LTS	All versions, plus listed versions 3.7.0-8ubuntu23.7.0-8ubuntu3	None known
`claws-mail` Ubuntu:24.04:LTS	All versions, plus listed versions 4.1.1-44.1.1-4build14.2.0-14.2.0-1ubuntu14.2.0-24.2.0-2build64.2.0-2build7	None known
`sylpheed` Ubuntu:24.04:LTS	All versions, plus listed versions 3.8.0~beta1-1ubuntu13.8.0~beta1-1ubuntu43.8.0~beta1-1ubuntu5	None known
`claws-mail` Ubuntu:25.10	All versions, plus listed versions 4.3.1-1	None known
`sylpheed` Ubuntu:25.10	All versions, plus listed versions 3.8.0~beta1-2ubuntu1	None known
`claws-mail` Ubuntu:26.10	All versions, plus listed versions 4.3.1-1ubuntu14.4.0-14.4.0-1build1	None known
`claws-mail` Ubuntu:26.04:LTS	All versions, plus listed versions 4.3.1-14.3.1-1build14.3.1-1build24.3.1-1ubuntu1	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 10 moreShow less