Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Balsa email client may run malicious code via IMAP

CVE-2007-5007 · published 18 years ago
Summary

If you use Balsa version earlier than 2.3.20, a specially crafted response from an IMAP mail server can cause the program to execute unwanted code. This could let an attacker take control of the computer that runs Balsa. Update Balsa to version 2.3.20 or later, or apply any security patches provided by your Linux distribution, to protect against this risk.

What to do
  • Update debian balsa to version 2.3.20-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian balsa < 2.3.20-1
Fix: upgrade to 2.3.20-1
Debian:13 debian balsa < 2.3.20-1
Fix: upgrade to 2.3.20-1
Debian:14 debian balsa < 2.3.20-1
Fix: upgrade to 2.3.20-1
– gnome balsa 1.1.7
1.2.4
1.4
1.4.3
2.0.6
2.0.10
2.0.16
2.0.17
2.0.18
2.1
2.1.1
2.1.2
28 more version ranges
cpe:2.3:a:gnome:balsa:1.1.7:*:*:*:*:*:*:*
Original advisory text
Stack-based buffer overflow in the ir_fetch_seq function in balsa before 2.3.20 might allow remote IMAP servers to execute arbitrary code via a long response to a FETCH command.
Stack-based buffer overflow in the ir_fetch_seq function in balsa before 2.3.20 might allow remote IMAP servers to execute arbitrary code via a long response to a FETCH command.
References
Severity
6.8 Medium
Exploitation
4% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published12 Dec 2007
Updated23 Oct 2026
First seen28 Sep 2026
Sources
DEBIAN-CVE-2007-5007 · OSV
CVE-2007-5007 · NVD
Track software like this
Free during beta