CVE-2019-10735 - CVE House
Back to Database
Status published Medium CVE-2019-10735

In Claws Mail 3.14.1, an attacker in possession of S/MIME...

Vulnerability Description

In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10735

Credits & Attribution

No credits recorded in the NVD database.

References

More from claws-mail

View All →
CVE-2021-37746
textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed...
Medium 6.1
CVE-2020-16094
In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP...
High 7.5
CVE-2020-15917
common/session.c in Claws Mail before 3.17.6 has a protocol violation...
Critical 9.8
CVE-2015-8708
Stack-based buffer overflow in the conv_euctojis function in codeconv.c in...
High 7.3
CVE-2015-8614
Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis,...
High 7.3

Affected Vendor

Affected Software

mail
Vulnerable Versions:
3.14.1

Timeline

Official Publish: April 7th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.