freron mailmate vulnerabilities

Latest freron mailmate CVEs

Newest publication first

1. CVE-2020-12619 MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate f...

   Published 2020-08-20

   Medium·CVSS 5.9 EPSS 0.43%

   MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. Th...

2. CVE-2018-15588 MailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email.

   Published 2019-02-11

   High·CVSS 7.5 EPSS 2.4%

   MailMate before 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email.

3. CVE-2017-17689 The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

   Published 2018-05-16

   Medium·CVSS 5.9 EPSS 4.1%

   The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.