Apple Mail vulnerabilities

6 CVEs affecting Apple Mail, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-17689, published 2018-05-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-17688, published 2018-05-16. Medium severity, CVSS 5.9. EPSS: 5.5% chance of exploitation in the next 30 days. The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a…
CVE-2017-17689, published 2018-05-16. Medium severity, CVSS 5.9. EPSS: 4.2% chance of exploitation in the next 30 days. The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
CVE-2008-0039, published 2008-02-12. Medium severity, CVSS 6.8. EPSS: 3.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Mail in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary commands via a crafted file:// URL.
CVE-2010-3887, published 2010-10-08. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. The Limit Mail feature in the Parental Controls functionality in Mail on Apple Mac OS X does not properly enforce the correspondence whitelist, which allows remote attackers to bypass intended access…
CVE-2008-4491, published 2008-10-08. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote…
CVE-2005-2512, published 2005-08-19. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Mail.app in Mac OS 10.4.2 and earlier, when printing or forwarding an HTML message, loads remote images even when the user's preferences state otherwise, which could result in a privacy leak.