Fedora has issued an advisory today (October 15): https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JUBLHUG2UCXVABAGN5FVTD3AB3YKE5NN/ The issue is fixed upstream in 3.17.7.
CC: (none) => jani.valimaa
Updated package uploaded for Mageia 7 by Jani. Advisory: ======================== Updated claws-mail packages fix security vulnerability: In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursion into subdirectories during a rebuild of the folder tree (CVE-2020-16094). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16094 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JUBLHUG2UCXVABAGN5FVTD3AB3YKE5NN/ ======================== Updated packages in core/updates_testing: ======================== claws-mail-3.17.7-1.mga7 claws-mail-tools-3.17.7-1.mga7 claws-mail-devel-3.17.7-1.mga7 claws-mail-plugins-3.17.7-1.mga7 claws-mail-acpi-plugin-3.17.7-1.mga7 claws-mail-address_keeper-plugin-3.17.7-1.mga7 claws-mail-archive-plugin-3.17.7-1.mga7 claws-mail-att_remover-plugin-3.17.7-1.mga7 claws-mail-attachwarner-plugin-3.17.7-1.mga7 claws-mail-bogofilter-plugin-3.17.7-1.mga7 claws-mail-bsfilter-plugin-3.17.7-1.mga7 claws-mail-clamd-plugin-3.17.7-1.mga7 claws-mail-dillo-plugin-3.17.7-1.mga7 claws-mail-fetchinfo-plugin-3.17.7-1.mga7 claws-mail-gdata-plugin-3.17.7-1.mga7 claws-mail-libravatar-plugin-3.17.7-1.mga7 claws-mail-litehtml_viewer-plugin-3.17.7-1.mga7 claws-mail-mailmbox-plugin-3.17.7-1.mga7 claws-mail-managesieve-plugin-3.17.7-1.mga7 claws-mail-newmail-plugin-3.17.7-1.mga7 claws-mail-notification-plugin-3.17.7-1.mga7 claws-mail-pdf_viewer-plugin-3.17.7-1.mga7 claws-mail-perl-plugin-3.17.7-1.mga7 claws-mail-pgpcore-plugin-3.17.7-1.mga7 claws-mail-pgpinline-plugin-3.17.7-1.mga7 claws-mail-pgpmime-plugin-3.17.7-1.mga7 claws-mail-python-plugin-3.17.7-1.mga7 claws-mail-rssyl-plugin-3.17.7-1.mga7 claws-mail-smime-plugin-3.17.7-1.mga7 claws-mail-spamassassin-plugin-3.17.7-1.mga7 claws-mail-spam_report-plugin-3.17.7-1.mga7 claws-mail-vcalendar-plugin-3.17.7-1.mga7 from claws-mail-3.17.7-1.mga7.src.rpm
Assignee: julien.moragny => qa-bugs
Testing this on M7-GNOME env x86_64 Update smoothly. Testing pop, imap, ssl/imap, ssl/pop with free.fr provider. OK Testing send mail via smtp and ssl/smtp free.fr provider. OK PGP key OK. Notifications OK. Gravatar OK. Seems OK. Validating.
Whiteboard: (none) => MGA7-64-OKCC: (none) => ouaurelien, sysadmin-bugsKeywords: (none) => validated_update
Advisory and packages in Comment 1. Advisory pushed to svn.
Keywords: (none) => advisory
The first bug fix in 3.17.8 sounds like a security issue as well: https://claws-mail.org/news.php
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0391.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED