A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A crash can occur in low-level/imf/mailimf.c during a failed parse of a Cc header containing multiple e-mail addresses.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libetpan | Libetpan_project | * | 1.7.2 (including) |
| Libetpan | Ubuntu | artful | * |
| Libetpan | Ubuntu | esm-apps/xenial | * |
| Libetpan | Ubuntu | trusty | * |
| Libetpan | Ubuntu | upstream | * |
| Libetpan | Ubuntu | xenial | * |
| Libetpan | Ubuntu | yakkety | * |
| Libetpan | Ubuntu | zesty | * |
Potential Mitigations
References
- https://github.com/dinhviethoa/libetpan/commit/1fe8fbc032ccda1db9af66d93016b49c16c1f22d
- https://github.com/dinhviethoa/libetpan/issues/274
- https://github.com/dinhviethoa/libetpan/releases/tag/1.8
- https://github.com/dinhviethoa/libetpan/commit/1fe8fbc032ccda1db9af66d93016b49c16c1f22d
- https://github.com/dinhviethoa/libetpan/issues/274
- https://github.com/dinhviethoa/libetpan/releases/tag/1.8