The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products.
CVSS Details
- CVSS 3.1 Base Score: 7.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Fetchmail | — | Apply OS X security update 2007-005 | Dec 16, 2011 | Apr 16, 2007 |
| Centos_linux | — | Upgrade ruby-rdocUpgrade ruby-modeUpgrade ruby-irbUpgrade ruby-riUpgrade ruby-docsUpgrade ruby-libsUpgrade ruby-tcltkUpgrade ruby-develUpgrade ruby | Dec 1, 2016 | Apr 16, 2007 |
| Debian | — | Upgrade muttUpgrade mailfilterUpgrade claws-mailUpgrade balsaUpgrade fetchmail | Jul 30, 2024 | Apr 16, 2007 |
| Freebsd | — | Upgrade claws-mailUpgrade fetchmail | Dec 10, 2025 | Apr 19, 2007 |
| Gentoo Linux | — | Upgrade www-client/mozilla-firefox.Upgrade net-libs/xulrunner.Upgrade www-client/seamonkey.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/seamonkey-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/mozilla-firefox-bin. | Oct 30, 2017 | Apr 16, 2007 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 1.1.2Upgrade to Mozilla SeaMonkey version 1.0.9 | Feb 3, 2012 | Apr 16, 2007 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 2.0.0.4Upgrade to Mozilla Thunderbird version 1.5.0.12 | Feb 22, 2012 | Apr 16, 2007 |
| Oracle_linux | — | Upgrade ruby-modeUpgrade ruby-irbUpgrade ruby-libsUpgrade ruby-docsUpgrade ruby-rdocUpgrade fetchmailUpgrade ruby-riUpgrade rubyUpgrade ruby-develUpgrade ruby-tcltkUpgrade muttUpgrade evolution-data-server-develUpgrade evolution-data-server | Oct 16, 2024 | Apr 16, 2007 |
| Suse | — | Upgrade fetchmailUpgrade muttUpgrade fetchmailconfUpgrade mutt-docUpgrade mutt-lang | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade fetchmailUpgrade mozilla-thunderbird | Nov 8, 2024 | Apr 16, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub