CVE-2020-16118

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by sending a PREAUTH response to imap_mbox_connect in libbalsa/imap/imap-handle.c.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00035.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00045.htmlMailing List, Third Party Advisory
https://gitlab.gnome.org/GNOME/balsa/-/commit/4e245d758e1c826a01080d40c22ca8706f0339e5Patch, Third Party Advisory
https://gitlab.gnome.org/GNOME/balsa/-/issues/23Exploit, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00035.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00045.htmlMailing List, Third Party Advisory
https://gitlab.gnome.org/GNOME/balsa/-/commit/4e245d758e1c826a01080d40c22ca8706f0339e5Patch, Third Party Advisory
https://gitlab.gnome.org/GNOME/balsa/-/issues/23Exploit, Third Party Advisory

Timeline

Published: Jul 29, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-161197.8Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_CVE-2020-161204.4Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user names CVE-2020-161213.3PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that CVE-2020-161227.8PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the co CVE-2020-161234.7An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from CVE-2020-161249.8Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated CVE-2020-161256.8gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely CVE-2020-161263.3An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped t CVE-2020-161275.5An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unboun CVE-2020-161283.8The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-20 CVE-2020-16137.5A vulnerability in the BGP FlowSpec implementation may cause a Juniper Networks Junos OS device to terminate an established BGP session upon CVE-2020-161316.1Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php.