{"id":"CVE-2016-10727","aliases":["DEBIAN-CVE-2016-10727","DLA-1443-1","EUVD-2016-1725","GHSA-7xwg-339m-2rw9","RHBA-2016:2206","UBUNTU-CVE-2016-10727","USN-3724-1"],"status":"published","title":"camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server...","description":"camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02889,"percentile":0.86976,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2018-07-20T00:00:00Z","modified":"2026-10-24T10:45:25Z","fixes":[{"ecosystem":"Debian:12","package":"evolution-data-server","fixed_in":["3.22.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"evolution-data-server","fixed_in":["3.22.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"evolution-data-server","fixed_in":["3.22.0-2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"evolution-data-server","fixed_in":["3.12.9~git20141128.5242b0-2+deb8u4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-data-server-debuginfo","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-data-server-devel","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-data-server-doc","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-mapi-debuginfo","fixed_in":["0:3.12.10-5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-mapi-devel","fixed_in":["0:3.12.10-5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openchange-client","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openchange-debuginfo","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openchange-devel","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openchange-devel-docs","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-data-server","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-ews","fixed_in":["0:3.12.11-9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-ews-debuginfo","fixed_in":["0:3.12.11-9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-mapi","fixed_in":["0:3.12.10-5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openchange","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"evolution-data-server","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"evolution-data-server-debuginfo","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"evolution-data-server-devel","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"evolution-data-server-doc","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-data-server-debuginfo","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-data-server-devel","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-data-server-doc","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-ews","fixed_in":["0:3.12.11-9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-ews-debuginfo","fixed_in":["0:3.12.11-9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-mapi","fixed_in":["0:3.12.10-5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-mapi-debuginfo","fixed_in":["0:3.12.10-5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-mapi-devel","fixed_in":["0:3.12.10-5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openchange","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openchange-client","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openchange-debuginfo","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openchange-devel","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openchange-devel-docs","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-data-server","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-data-server-doc","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-mapi-debuginfo","fixed_in":["0:3.12.10-5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-mapi-devel","fixed_in":["0:3.12.10-5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openchange-client","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openchange-debuginfo","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openchange-devel","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openchange-devel-docs","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-data-server","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-data-server-debuginfo","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-data-server-devel","fixed_in":["0:3.12.11-37.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-ews","fixed_in":["0:3.12.11-9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-ews-debuginfo","fixed_in":["0:3.12.11-9.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-mapi","fixed_in":["0:3.12.10-5.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openchange","fixed_in":["0:2.3-2.el7"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"evolution-data-server","fixed_in":["3.10.4-0ubuntu1.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"evolution-data-server","fixed_in":["3.18.5-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.9~git20141128.5242b0-2+deb8u4"}]}],"versions":["3.12.9~git20141128.5242b0-2+deb8u2","3.12.9~git20141128.5242b0-2+deb8u3"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-data-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-data-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-data-server-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-mapi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.10-5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-mapi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.10-5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openchange-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openchange-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openchange-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openchange-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-ews","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-ews-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"evolution-mapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.10-5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openchange","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"evolution-data-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"evolution-data-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"evolution-data-server-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-data-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-data-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-data-server-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-ews","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-ews-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-mapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.10-5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-mapi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.10-5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-mapi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.10-5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openchange","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openchange-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openchange-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openchange-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openchange-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-data-server-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-mapi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.10-5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-mapi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.10-5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openchange-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openchange-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openchange-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openchange-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-data-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-data-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-37.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-ews","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-ews-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.11-9.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"evolution-mapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.10-5.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openchange","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3-2.el7"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.4-0ubuntu1.6"}]}],"versions":["3.8.5-1ubuntu3","3.8.5-1ubuntu4","3.10.1-2ubuntu2","3.10.1-2ubuntu3","3.10.3-0ubuntu1","3.10.3-0ubuntu2","3.10.4-0ubuntu1","3.10.4-0ubuntu1.1","3.10.4-0ubuntu1.2","3.10.4-0ubuntu1.3","3.10.4-0ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.5-1ubuntu1.1"}]}],"versions":["3.16.5-1ubuntu3","3.18.1-1ubuntu1","3.18.2-0ubuntu1","3.18.2-0ubuntu2","3.18.3-1ubuntu1","3.18.3-1ubuntu2","3.18.4-0ubuntu1","3.18.5-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.4-0ubuntu1.6"}]}],"versions":["3.8.5-1ubuntu3","3.8.5-1ubuntu4","3.10.1-2ubuntu2","3.10.1-2ubuntu3","3.10.3-0ubuntu1","3.10.3-0ubuntu2","3.10.4-0ubuntu1","3.10.4-0ubuntu1.1","3.10.4-0ubuntu1.2","3.10.4-0ubuntu1.3","3.10.4-0ubuntu1.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"evolution-data-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.5-1ubuntu1.1"}]}],"versions":["3.16.5-1ubuntu3","3.18.1-1ubuntu1","3.18.2-0ubuntu1","3.18.2-0ubuntu2","3.18.3-1ubuntu1","3.18.3-1ubuntu2","3.18.4-0ubuntu1","3.18.5-1ubuntu1"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"gnome","product":"evolution"}],"references":[{"url":"https://github.com/GNOME/evolution-data-server/releases/tag/EVOLUTION_DATA_SERVER_3_21_2","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/evolution-data-server/blob/master/NEWS#L1022","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1334842","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/3724-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://gitlab.gnome.org/GNOME/evolution-data-server/commit/f26a6f67","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10727","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7xwg-339m-2rw9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10727","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2016:2206","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1204373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1264957","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1265684","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1278701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1288099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1314261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1322908","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1326634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1337259","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1346179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1362674","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1367455","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhba-2016_2206.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1609916","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10727","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2016-10727","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3724-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-10727","description":"camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.","status":"published","published":"2018-07-20T04:00:00Z","modified":"2024-08-06T03:30:20.132Z","updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2016-1725","description":"camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.","status":"published","published":"2018-07-20T04:00:00Z","modified":"2024-08-06T03:30:20Z","updated_at":"2026-11-03T02:22:23.66215Z"}],"ghsa":[{"id":"GHSA-7xwg-339m-2rw9","title":"camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server...","description":"camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.","status":"published","published":"2022-05-14T02:59:15Z","modified":"2023-02-02T05:06:43Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:52:21.13569Z"}],"nvd":[{"id":"CVE-2016-10727","description":"camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.","status":"published","published":"2018-07-20T04:29:00.227Z","modified":"2026-06-17T00:40:14.58Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:39.621168Z"}],"osv":[{"id":"CVE-2016-10727","description":"camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.","status":"published","published":"2018-07-20T04:29:00.227Z","modified":"2026-10-24T10:45:25.107808325Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10727","description":"camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.","status":"published","published":"2018-07-20T04:29:00.227Z","modified":"2026-09-22T07:01:13.823170248Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"RHBA-2016:2206","title":"Red Hat Bug Fix Advisory: evolution-data-server bug fix update","status":"published","published":"2024-09-15T23:17:07Z","modified":"2026-06-27T10:03:47Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"UBUNTU-CVE-2016-10727","description":"camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.","status":"published","published":"2018-07-20T00:00:00Z","modified":"2026-04-22T10:31:04.819752Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"DLA-1443-1","title":"evolution-data-server - security update","status":"published","published":"2018-07-25T00:00:00Z","modified":"2026-03-09T01:01:10.77025Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"USN-3724-1","title":"evolution-data-server vulnerability","description":"Jon Kristensen discovered that Evolution Data Server would automatically\ndowngrade a connection to an IMAP server if the IMAP server did not support\nSSL. This would result in the user's password being unexpectedly sent in clear\ntext, even though the user had requested to use SSL.\n","status":"published","published":"2018-07-26T13:27:57Z","modified":"2026-04-22T09:47:36.512602Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}