Gnome Balsa vulnerabilities

3 CVEs affecting Gnome Balsa, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-16118, published 2020-07-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2007-5007, published 2007-12-12. Medium severity, CVSS 6.8. EPSS: 3.9% chance of exploitation in the next 30 days. Stack-based buffer overflow in the ir_fetch_seq function in balsa before 2.3.20 might allow remote IMAP servers to execute arbitrary code via a long response to a FETCH command.
CVE-2020-16118, published 2020-07-29. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by sending a PREAUTH response to imap_mbox_connect in…
CVE-2020-13645, published 2020-05-28. Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days. In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server…