The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.
CVSS Details
- CVSS 3.1 Base Score: 7.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Fetchmail | — | Apply OS X security update 2007-005 | Dec 16, 2011 | Apr 16, 2007 |
| Centos_linux | — | Upgrade ruby-rdocUpgrade ruby-libsUpgrade ruby-irbUpgrade rubyUpgrade ruby-riUpgrade ruby-docsUpgrade ruby-tcltkUpgrade ruby-modeUpgrade ruby-devel | Dec 1, 2016 | Apr 16, 2007 |
| Debian | — | Upgrade claws-mailUpgrade mailfilterUpgrade muttUpgrade fetchmailUpgrade balsa | Jul 30, 2024 | Apr 16, 2007 |
| Freebsd | — | Upgrade fetchmailUpgrade claws-mail | Dec 10, 2025 | Apr 19, 2007 |
| Gentoo Linux | — | Upgrade www-client/seamonkey-bin.Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/seamonkey.Upgrade mail-client/mozilla-thunderbird.Upgrade net-libs/xulrunner.Upgrade www-client/mozilla-firefox. | Oct 30, 2017 | Apr 16, 2007 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.0.9Upgrade to Mozilla SeaMonkey version 1.1.2 | Feb 3, 2012 | Apr 16, 2007 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 1.5.0.12Upgrade to Mozilla Thunderbird version 2.0.0.4 | Feb 22, 2012 | Apr 16, 2007 |
| Oracle_linux | — | Upgrade ruby-modeUpgrade ruby-rdocUpgrade ruby-docsUpgrade ruby-libsUpgrade fetchmailUpgrade ruby-riUpgrade ruby-irbUpgrade ruby-tcltkUpgrade ruby-develUpgrade evolution-data-server-develUpgrade muttUpgrade rubyUpgrade evolution-data-server | Oct 16, 2024 | Apr 16, 2007 |
| Suse | — | Upgrade mutt-langUpgrade fetchmailconfUpgrade mutt-docUpgrade fetchmailUpgrade mutt | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade fetchmailUpgrade mozilla-thunderbird | Nov 8, 2024 | Apr 16, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub