Secunia Research has discovered a vulnerability in Sylpheed and Sylpheed-Claws (Claws Mail), which can be exploited by malicious people to compromise a vulnerable system.

A format string error in the "inc_put_error()" function in src/inc.c when displaying a POP3 server's error response can be exploited via specially crafted POP3 server replies containing format specifiers.

Successful exploitation may allow execution of arbitrary code, but requires that the user is tricked into connecting to a malicious POP3 server.

The vulnerability is confirmed in Sylpheed 2.4.4, Sylpheed-Claws 1.9.100, and Sylpheed-Claws (Claws Mail) 2.10.0. Prior versions may also be affected.

Solution
Update to Sylpheed 2.4.5 or upgrade to Claws Mail 3.0.0.
Further details available to Secunia VIM customers

Provided and/or discovered by
Ulf Harnhammar, Secunia Research.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2007-70/

Deep Links
Links available to Secunia VIM customers