In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by sending a PREAUTH response to imap_mbox_connect in libbalsa/imap/imap-handle.c.
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Balsa | Gnome | * | 2.6.0 (excluding) |
| Balsa | Ubuntu | bionic | * |
| Balsa | Ubuntu | trusty | * |
| Balsa | Ubuntu | upstream | * |
| Balsa | Ubuntu | xenial | * |