{"id":"CVE-2020-15917","aliases":["ALPINE-CVE-2020-15917","DEBIAN-CVE-2020-15917","EUVD-2020-7889","GHSA-9rxj-vjg6-w53x","MGASA-2020-0321","UBUNTU-CVE-2020-15917","openSUSE-SU-2020:1116-1","openSUSE-SU-2020:1139-1","openSUSE-SU-2020:1192-1","openSUSE-SU-2020:1269-1","openSUSE-SU-2020:1822-1","openSUSE-SU-2021:1045-1","openSUSE-SU-2024:10686-1"],"status":"published","title":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after...","description":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02614,"percentile":0.8553,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2020-07-23T18:06:26Z","modified":"2026-11-03T06:31:40Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"claws-mail","fixed_in":["3.17.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"claws-mail","fixed_in":["3.17.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"claws-mail","fixed_in":["3.17.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"claws-mail","fixed_in":["3.17.6-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"claws-mail","fixed_in":["3.17.6-1.mga7"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"claws-mail","fixed_in":["3.17.3-lp151.2.3.1","3.17.8-bp152.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"claws-mail","fixed_in":["3.17.6-lp152.3.3.1","3.17.8-bp152.3.6.1","3.18.0-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"claws-mail","fixed_in":["3.17.6-bp152.3.3.1","3.17.8-bp152.3.6.1","3.18.0-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"claws-mail","fixed_in":["3.17.3-bp151.3.3.1","3.17.8-bp152.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"claws-mail","fixed_in":["3.18.0-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"claws-mail","fixed_in":["3.18.0-bp153.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.0-1ubuntu1","3.12.0-1ubuntu2","3.13.1-1.1ubuntu1","3.13.1-1.1ubuntu2","3.13.1-1.1ubuntu3","3.13.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.15.0-2build2","3.15.1-1","3.15.1-1ubuntu1","3.16.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.17.4-1","3.17.4-1build1","3.17.4-2build2","3.17.4-2ubuntu1","3.17.5-2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.3-lp151.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-lp152.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.6-bp152.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.3-bp151.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.8-bp152.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.8-bp152.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.8-bp152.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.8-bp152.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"claws-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-2.5"}]}],"bundled":2}],"products":[{"vendor":"claws-mail","product":"claws-mail"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://git.claws-mail.org/?p=claws.git%3Ba=commit%3Bh=fcc25329049b6f9bd8d890f1197ed61eb12e14d5","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://git.claws-mail.org/?p=claws.git%3Ba=blob%3Bf=RELEASE_NOTES","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202007-56","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00090.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G7UX65342HRVDQML4G4GEVEUB764EUM5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YVQB7NRBHO67Q74RS7RZCMW4ENRVBB4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00060.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00051.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15917"},{"url":"https://git.claws-mail.org/?p=claws.git;a=blob;f=RELEASE_NOTES","tags":["report"]},{"url":"https://git.claws-mail.org/?p=claws.git;a=commit;h=fcc25329049b6f9bd8d890f1197ed61eb12e14d5","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6YVQB7NRBHO67Q74RS7RZCMW4ENRVBB4/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G7UX65342HRVDQML4G4GEVEUB764EUM5/"},{"url":"https://github.com/advisories/GHSA-9rxj-vjg6-w53x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-15917","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15917","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0321.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27040","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/G7UX65342HRVDQML4G4GEVEUB764EUM5/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-15917","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15917","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BZEDQ22SMIT6BH5HL2OGDYUWITQ5N5OY/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174457","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15917","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2VZI6IM4FOADBLISYX3SV7H6LHDM5EBO/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7225RKUAEWWZOB442JKYYX2AXX7OYI6G/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KDC7A34CJH6GSSHTZVUWPFP3DTSRITIB/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TJZJ7GCA3H35VDJV4TSCXVOQHIMHDZYO/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157594","tags":["report"]},{"url":"https://bugzilla.suse.com/1177967","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2VE6WDEXX6HETWFB6EGOWAEY6QQSAI6E/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1558","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-15917","description":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.","status":"published","published":"2020-07-23T18:06:26Z","modified":"2024-08-04T13:30:23.272Z","updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-7889","description":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.","status":"published","published":"2020-07-23T18:06:26Z","modified":"2024-08-04T13:30:23Z","updated_at":"2026-11-03T03:07:29.843843Z"}],"ghsa":[{"id":"GHSA-9rxj-vjg6-w53x","title":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after...","description":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.","status":"published","published":"2022-05-24T17:24:16Z","modified":"2023-01-28T05:02:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:43:50.688054Z"}],"nvd":[{"id":"CVE-2020-15917","description":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.","status":"published","published":"2020-07-23T19:15:10.137Z","modified":"2026-06-17T02:57:23.953Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:10.086163Z"}],"osv":[{"id":"ALPINE-CVE-2020-15917","description":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.","status":"published","published":"2020-07-23T19:15:10.137Z","modified":"2026-11-03T06:31:40.807504975Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2020-15917","description":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.","status":"published","published":"2020-07-23T19:15:10.137Z","modified":"2026-04-16T04:32:04.981291445Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-15917","description":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.","status":"published","published":"2020-07-23T19:15:10.137Z","modified":"2026-10-26T12:00:47.42885299Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-15917","description":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.","status":"published","published":"2020-07-23T19:15:00Z","modified":"2026-04-22T12:30:59.451843Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"MGASA-2020-0321","title":"Updated claws-mail packages fix security vulnerability","description":"common/session.c in Claws Mail before 3.17.6 has a protocol violation because\nsuffix data after STARTTLS is mishandled (CVE-2020-15917).\n","status":"published","published":"2020-08-18T17:41:27Z","modified":"2026-04-16T04:43:09.924978446Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:1116-1","title":"Security update for claws-mail","description":"This update for claws-mail fixes the following issues:\n\n- CVE-2020-15917: Fixed an improper handling of suffix data after STARTTLS is mishandled (boo#1174457).\n","status":"published","published":"2020-07-31T14:30:02Z","modified":"2026-02-04T03:24:00.565211Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1139-1","title":"Security update for claws-mail","description":"This update for claws-mail fixes the following issues:\n\n- Update to 3.17.6:\n * It is now possible to 'Inherit Folder properties and processing\n   rules from parent folder' when creating new folders with the\n   move message and copy message dialogues.\n * A Phishing warning is now shown when copying a phishing URL, (in\n   addition to clicking a phishing URL).\n * The progress window when importing an mbox file is now more\n   responsive.\n * A warning dialogue is shown if the selected privacy system is\n   'None' and automatic signing amd/or encrypting is enabled.\n * Python plugin: pkgconfig is now used to check for python2. This\n   enables the Python plugin (which uses python2) to be built on\n   newer systems which have both python2 and python3.\n- CVE-2020-15917: Fixed an improper handling of suffix data after STARTTLS is mishandled (boo#1174457).\n","status":"published","published":"2020-08-03T12:23:30Z","modified":"2026-02-04T04:23:01.617543Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1192-1","title":"Security update for claws-mail","description":"This update for claws-mail fixes the following issues:\n\n- Update to 3.17.6:\n * It is now possible to 'Inherit Folder properties and processing\n   rules from parent folder' when creating new folders with the\n   move message and copy message dialogues.\n * A Phishing warning is now shown when copying a phishing URL, (in\n   addition to clicking a phishing URL).\n * The progress window when importing an mbox file is now more\n   responsive.\n * A warning dialogue is shown if the selected privacy system is\n   'None' and automatic signing amd/or encrypting is enabled.\n * Python plugin: pkgconfig is now used to check for python2. This\n   enables the Python plugin (which uses python2) to be built on\n   newer systems which have both python2 and python3.\n- CVE-2020-15917: Fixed an improper handling of suffix data after STARTTLS is mishandled (boo#1174457).\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2020-08-12T10:24:31Z","modified":"2026-02-04T03:27:16.507947Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1269-1","title":"Security update for claws-mail","description":"This update for claws-mail fixes the following issues:\n\n- CVE-2020-15917: Fixed an improper handling of suffix data after STARTTLS is mishandled (boo#1174457).\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-08-27T04:21:24Z","modified":"2026-02-04T03:59:28.46361Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1822-1","title":"Security update for claws-mail","description":"This update for claws-mail fixes the following issues:\n\n- Additional cleanup of the template handling\n\nclaws-mail was updated to 3.17.8 (boo#1177967)\n\n  * Shielded template's |program{} and |attach_program{} so that the\n    command-line that is executed does not allow sequencing such as\n    with \u0026\u0026 || ;, preventing possible execution of nasty, or at least\n    unexpected, commands\n  * bug fixes: claws#4376\n  * updated English, French, and Spanish manuals\n\n- Update to 3.17.7 \n\n  * Image Viewer: Image attachments, when displayed, are now resized\n    to fit the available width rather than the available height.\n  * -d is now an alias to --debug.\n  * Libravatar plugin: New styles supported: Robohash and Pagan.\n  * SpamAssassin plugin: The 'Maximum size' option now matches\n    SpamAssassin's maximum; it can now handle messages up to 256MB.\n  * LiteHTML viewer plugin: The UI is now translatable.\n  Bug fixes:\n  * bug 4313, 'Recursion stack overflow with rebuilding folder\n    tree'\n  * bug 4372, '[pl_PL] Crash after 'Send later' without\n    recipient and then 'Close''\n  * bug 4373, 'attach mailto URI double free'\n  * bug 4374, 'insert mailto URI misses checks'\n  * bug 4384, 'U+00AD (soft hyphen) changed to space in\n    Subject'\n  * bug 4386, 'Allow Sieve config without userid without\n    warning'\n  * Add missing SSL settings when cloning accounts.\n  * Parsing of command-line arguments.\n  * PGP Core plugin: fix segv in address completion with a\n    keyring.\n  * Libravatar plugin: fixes to image display.\n\n- Disable python-gtk plugin on suse_version \u003e 1500: still relying\n  on python2, which is EOL.\n\n- Update to 3.17.6:\n\n  * It is now possible to 'Inherit Folder properties and processing\n    rules from parent folder' when creating new folders with the\n    move message and copy message dialogues.\n  * A Phishing warning is now shown when copying a phishing URL, (in\n    addition to clicking a phishing URL).\n  * The progress window when importing an mbox file is now more\n    responsive.\n  * A warning dialogue is shown if the selected privacy system is\n    'None' and automatic signing amd/or encrypting is enabled.\n  * Python plugin: pkgconfig is now used to check for python2. This\n    enables the Python plugin (which uses python2) to be built on\n    newer systems which have both python2 and python3.\n  Bug fixes:\n  * bug 3922, 'minimize to tray on startup not working'\n  * bug 4220, 'generates files in cache without content'\n  * bug 4325, 'Following redirects when retrieving image'\n  * bug 4342, 'Import mbox file command doesn't work twice on a row'\n  * fix STARTTLS protocol violation\n  * fix initial debug line\n  * fix fat-fingered crash when v (hiding msgview) is pressed\n    just before c (check signature)\n  * fix non-translation of some Templates strings\n\n\n- Update to 3.17.5\n\n  + Inline Git patches now have colour syntax highlighting\n    The colours of these, and patch attachments, are configurable on\n    the 'Other' tab of the Display/Colors page of the general\n    preferences.\n  + The previously hidden preference, 'summary_from_show', is now\n    configurable within the UI, on the 'Message List' tab of the\n    Display/Summaries page of the general preferences, 'Displayed in\n    From column [ ]'.\n  + 'Re-edit' has been added to the message context menu when in the\n    Drafts folder.\n  + Additional Date header formats are supported:\n    - weekday, month, day, hh, mm, ss, year, zone\n    - weekday, month, day, hh, mm, ss, year\n  + LiteHtml viewer plugin: scrolling with the keyboard has been\n    implemented.\n  + The included tools/scripts have been updated:\n    - eud2gc.py converted to Python 3\n    - tbird2claws.py converted to Python 3\n    - tbird2claws.py converted to Python 3\n    - google_search.pl has been replaced with ddg_search.pl (that is,\n      duckduckgo.com instead of google.com)\n    - fix_date.sh and its documentation have been updated \n    - multiwebsearch.pl 'fm' (freshmeat.net) has been removed; 'google'\n      has been replaced by 'ddg'\n    - the outdated OOo2claws-mail.pl script has been removed\n  + Updated manuals\n  + Updated translations: British English, Catalan, Czech, Danish,\n    Dutch, French, German, Russian, Slovak, Spanish, Swedish,\n    Traditional Chinese, Turkish\n  + bug fixes: claws#2131, claws#4237, claws#4239, claws#4248, \n    claws#4253, claws#4257, claws#4277, claws#4278, claws#4305\n  + Misc bugs fixed:\n    - Fix crash in litehtml_viewer when  tag has no href\n    - removed 'The following file has been attached...' dialogue\n    - MBOX import: give a better estimation of the time left and\n      grey out widgets while importing\n    - Fixed 'vcard.c:238:2: warning: ‘strncpy’ output truncate \n      before terminating nul copying as many bytes from a string\n      as its length'\n    - RSSyl: Fix handling deleted feed items where modified and\n      published dates do not match \n    - fix bolding of target folder\n    - when creating a new account, don't pre-fill data from the\n      default account\n    - respect 'default selection' settings when moving a msg with\n      manual filtering\n    - Fix printing of empty pages when the selected part is\n      rendered with a plugin not implementing print\n    - Addressbook folder selection dialogs: make sure folder list\n      is sorted and apply global prefs to get stripes in lists.\n    - when user cancels the GPG signing passphrase dialogue,\n      don't bother the user with an 'error' dialogue\n    - Fix imap keyword search. Libetpan assumes keyword search is\n      a MUST but RFC states it is a MAY. Fix advanced search on\n      MS Exchange\n    - fix SHIFT+SPACE in msg list, moving in reverse\n    - revert pasting images as attachments\n    - Fix help about command-line arguments that require a\n      parameter.\n    - Printing: only print as plain text if the part is of type\n      text\n    - fix a segfault with default info icon when trying to print\n     a non-text part.\n\n- Add a test on build-time libetpan version to require the proper\n  version at run-time (boo#1157594)\n\n- Move 'Mark all read/unread' menu entries where they belong.\n  remove-MarkAll-from-message-menu.patch (claws#4278)\n  add-MarkAll-to-folder-menu.patch (claws#4278)\n\n- Make litehtml plugin build on Tumbleweed.\n\n- Update to 3.17.4:\n\n  * New HTML viewer plugin: Litehtml viewer\n  * Added option 'Enable keyboard shortcuts' to the 'Keyboard\n    shortcuts' frame on /Configuration/Preferences/Other/Miscellaneous\n  * Compose: implemented copying of attached images to clipboard\n  * Compose: images and text/uri-list (files) can now be attached by\n    pasting into the Compose window\n  * Python plugin: window sizes are now remembered for the Python\n    console, the 'Open URLs' and the 'Set mailbox order' windows.\n  * Fancy plugin: the download-link feature now follows redirections\n  * MBOX export: the Enter key in the dialogue now starts the export\n  * The date (ISO format) has been added to log timestamps\n  * Update translations\n    - bug 1920, 'No automatic NNTP filtering'\n    - bug 2045, 'address book blocks focus on email window'\n    - bug 2131, 'Focus stealing after mail check'\n    - bug 2627, 'Filtering does not work on NNTP'\n    - bug 3070, 'misbehaving text wrapping when URL chars are present'\n    - bug 3838, 'Canceled right-click on message list leaves UI\n      in inconsistent state'\n    - bug 3977, 'Fix crashes when some external APIs fail'\n    - bug 3979, 'Hang (with killing needed) during action which\n      extracts attachments'\n    - bug 4029, 'segfault after deleting message in a window'\n    - bug 4031, 'fingerprint in SSL/TLS certificates for ...\n      (regress error)'\n    - bug 4037, 'Fix some small issues'\n    - bug 4142, 'Translation error on Russian'\n    - bug 4145, 'proxy server for sending doesn't work'\n    - bug 4155, 'remember directory of last saving'\n    - bug 4166, 'corrupted double-linked list'\n    - bug 4167, 'Max line length exceeded when forwarding mail'\n    - bug 4188, 'STL file is sent not as an attachment but as its\n      base64 representation in plaintext'\n    - CID 1442278, 'impossible to trigger buffer overflow'\n    - Make key accelerators from menu work in addressbook window\n    - save checkbox choices of display/summaries/defaults prefs\n    - Do not throw an error when cancelling 'Save email as...'.\n    - occasional crash on drag'n'drop of msgs\n    - possible stack overflow in vcalendar's Curl data handler\n    - crash when LDAP address source is defined in index, but\n    - support is disabled\n    - crash in Fancy plugin if one of the MIME parts has no\n    - -ID\n    - a few small memory leaks in scan_mailto_url()\n    - configure script for rare cases where python is not\n      installed\n    - incorrect charset conversion in sc_html_read_line().\n    - markup in 'key not fully trusted' warning in pgpcore\n    - use after free in rare code path in rssyl_subscribe()\n    - several memory leaks\n    - verify_folderlist_xml() for fresh starts\n    - printf formats for size_t and goffset arguments.\n    - alertpanel API use in win32 part of mimeview.c\n    - pid handling in debug output of kill_children_cb()\n    - incorrect pointer arithmetic in w32_filesel.c\n","status":"published","published":"2020-11-02T23:25:05Z","modified":"2026-02-04T03:47:47.414749Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2021:1045-1","title":"Security update for claws-mail","description":"This update for claws-mail fixes the following issues:\n\nUpdate to 3.18.0\n\n  * Support for the OAuth2 authorisation protocol has been added for\n    IMAP, POP and SMTP using custom, user-generated client IDs.\n    OAuth2 preferences are found in the Account Preferences on the\n    Receive page (for POP: Authenticate before POP connection, for\n    IMAP: Authentication method); the Send page (SMTP authentication:\n    Authentication method); and on a dedicated OAuth2 page.\n  * The option 'Save (X-)Face in address book if possible' has been\n    added to the /Message View/Text Options preferences page.\n    Previously the (X-)Face would be saved automatically, therefore\n    this option is turned on by default.\n  * The Image Viewer has been reworked. New options have been added to\n    /Message View/Image Viewer: when resizing images, either fit the\n    image width or fit the image height to the available space.\n    Fitting the image height is the default. Regardless of this\n    setting, when displaying images inline they will fit the height.\n    When displaying an image, left-clicking the image will toggle\n    between full size and reduced size; right-clicking will toggle\n    between fitting the height and fitting the width.\n  * When re-editing a saved message, it is now possible to use\n    /Options/Remove References.\n  * It is now possible to attempt to retrieve a missing GPG key via\n    WKD.\n  * The man page has been updated.\n  * Updated translations: Brazilian Portuguese, British English,\n    Catalan, Czech, Danish, Dutch, French, Polish, Romanian, Russian,\n    Slovak, Spanish, Traditional Chinese, Turkish.\n  * bug fixes: claws#2411, claws#4326, claws#4394, claws#4431,\n               claws#4445, claws#4447, claws#4455, claws#4473\n    - stop WM's X button from causing GPG key fetch attempt\n    - Make fancy respect default font size for messageview\n    - harden link checker before accepting click\n    - non-display of (X-)Face when prefs_common.enable_avatars\n      is AVATARS_ENABLE_RENDER (2)\n    - debian bug #983778, 'Segfault on selecting empty 'X-Face'\n      custom header'\n\n  * It is now possible to 'Inherit Folder properties and processing\n    rules from parent folder' when creating new folders with the\n    move message and copy message dialogues.\n  * A Phishing warning is now shown when copying a phishing URL, (in\n    addition to clicking a phishing URL).\n  * The progress window when importing an mbox file is now more\n    responsive.\n  * A warning dialogue is shown if the selected privacy system is\n    'None' and automatic signing amd/or encrypting is enabled.\n  * Python plugin: pkgconfig is now used to check for python2. This\n    enables the Python plugin (which uses python2) to be built on\n    newer systems which have both python2 and python3.\n\n  Bug fixes:\n\n  * bug 3922, 'minimize to tray on startup not working'\n  * bug 4220, 'generates files in cache without content'\n  * bug 4325, 'Following redirects when retrieving image'\n  * bug 4342, 'Import mbox file command doesn't work twice on a row'\n  * fix STARTTLS protocol violation CVE-2020-15917 boo#1174457)\n  * fix initial debug line\n  * fix fat-fingered crash when v (hiding msgview) is pressed\n    just before c (check signature)\n  * fix non-translation of some Templates strings\n\n","status":"published","published":"2021-07-15T22:06:35Z","modified":"2026-02-04T03:39:07.531719Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10686-1","title":"claws-mail-4.0.0-2.5 on GA media","description":"These are all security issues fixed in the claws-mail-4.0.0-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:51.863726Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}