Claws Mail is a lightweight, open-source email client that maintains a focused product scope centered on the mail application itself and related calendar tooling. The vendor's vulnerability disclosures concentrate on improper link resolution and file-access handling, reflecting the attack surface inherent to parsing and processing untrusted message content and calendar data. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Claws Mail over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-15917CRITICAL common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled. | Jul 23, 2020 | 9.8 | 32 | NO | NO |
CVE-2021-37746MEDIUM textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click. | Jul 30, 2021 | 6.1 | 22 | NO | NO |
CVE-2020-16094HIGH In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursion into subdirectories during a rebuild | Jul 28, 2020 | 7.5 | 20 | NO | NO |
CVE-2012-5527MEDIUM Claws Mail vCalendar plugin: credentials exposed on interface | Nov 25, 2019 | 5.5 | 19 | NO | NO |
CVE-2015-8708HIGH Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified impact via a crafted email, involving Japan | Apr 11, 2016 | 7.3 | 19 | NO | NO |
CVE-2015-8614HIGH Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote attackers | Apr 11, 2016 | 7.3 | 19 | NO | NO |
CVE-2019-10735MEDIUM In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be | Apr 7, 2019 | 4.3 | 18 | NO | NO |
CVE-2014-2576MEDIUM plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof serve | Oct 15, 2014 | 6.8 | 18 | NO | NO |
CVE-2012-4507MEDIUM The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted email | Oct 22, 2012 | 5.0 | 18 | NO | NO |
sylprint.pl in claws mail tools (claws-mail-tools) allows local users to overwrite arbitrary files via a symlink attack on the sylprint.[USER].[PID] temporary file. | Dec 4, 2007 | 3.6 | 13 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Claws Mail.
Media articles that mention a CVE ID that affects a product developed by Claws Mail — matched by CVE ID, not by vendor name.