ALT-PU-2020-2597

Низкий

ALT-PU-2020-2597: package kde5-kmail update to version 20.04.3-alt1

Источник

errata.altlinux.org

Дата публикации

16.08.2020

Дата обновления

16.08.2020

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades kde5-kmail to version 20.04.3-alt1.

Устраненные уязвимости2

CVE-2020-15954

Средний 6.5

Дата публикации: 27.07.2020

CWE-319

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

CVSS 3.1

Средний 6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS 2.0

Средний 4.3

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access vector: Network
Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: None
Availability: None

Ссылки

CVE-2020-15954 https://nvd.nist.gov/vuln/detail/CVE-2020-15954

Ссылки1

ALT-PU-2020-2597 https://errata.altlinux.org/ALT-PU-2020-2597

Связанные уязвимости

CVE-2020-15954

CVSS3: 6.5

ubuntu

больше 6 лет назад

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

CVE-2020-15954

CVSS3: 6.5

nvd

больше 6 лет назад

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

CVE-2020-15954

CVSS3: 6.5

debian

больше 6 лет назад

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communicati ...

CVE-2021-38373

CVSS3: 5.3

ubuntu

больше 5 лет назад

In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.

CVE-2021-38373

CVSS3: 6.5

redhat

больше 5 лет назад

In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.