« Volver al listado

CVE-2007-2958

Estado: ModificadaMedia (6.8)—

Format string vulnerability in the inc_put_error function in src/inc.c in Sylpheed 2.4.4, and Sylpheed-Claws (Claws Mail) 1.9.100 and 2.10.0, allows remote POP3 servers to execute arbitrary code via format string specifiers in crafted replies.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Sylpheed — SylpheedSylpheed-claws — Sylpheed-claws

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-2958",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT-CNA@flexerasoftware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-08-27T17:17:00.000",
  "references": [
    {
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=190104",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://osvdb.org/40184",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://secunia.com/advisories/26550",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://secunia.com/advisories/26610",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://secunia.com/advisories/27229",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://secunia.com/advisories/27379",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://secunia.com/secunia_research/2007-70/advisory/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200710-29.xml",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://www.novell.com/linux/security/advisories/2007_20_sr.html",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/25430",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/2971",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=254121",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36238",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00077.html",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=190104",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/40184",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26550",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26610",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27229",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27379",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/secunia_research/2007-70/advisory/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://security.gentoo.org/glsa/glsa-200710-29.xml",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.novell.com/linux/security/advisories/2007_20_sr.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/25430",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/2971",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=254121",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36238",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00077.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Format string vulnerability in the inc_put_error function in src/inc.c in Sylpheed 2.4.4, and Sylpheed-Claws (Claws Mail) 1.9.100 and 2.10.0, allows remote POP3 servers to execute arbitrary code via format string specifiers in crafted replies."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de formato de cadena en la función inc_put_error en src/inc.c en Sylpheed 2.4.4, y Sylpheed-Claws (Claws Mail) 1.9.100 y 2.10.0, permite a servidores POP3 remotos ejecutar código de su elección a través de especificaciones de formato de cadena en respuestas manipuladas."
    }
  ],
  "lastModified": "2026-06-16T22:40:46.893",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sylpheed:sylpheed:2.4.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0B9CA4A-A38F-416E-8932-E12A0EB3F2C8"
            },
            {
              "criteria": "cpe:2.3:a:sylpheed-claws:sylpheed-claws:1.9.100:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F114852D-4966-424F-883B-3223B2D6CB96"
            },
            {
              "criteria": "cpe:2.3:a:sylpheed-claws:sylpheed-claws:2.10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B33723FF-72E4-4CBF-814A-CBFB17BD87AB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "Not vulnerable.  This issue did not affect version of Sylpheed as shipped with Red Hat Enterprise Linux 2.1.  Sylpheed and claws-mail are not shipped with Red Hat Enterprise Linux 3, 4, or 5.\n",
      "lastModified": "2007-08-28T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"
}