Apple Mail vulnerabilities

3 vulnerabilities

Known vulnerabilities in Apple Mail, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5CVE-2008-4491applemail
EPSS score
1.20%
Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on the email server, which allows server owners and remote man-in-the-middle attackers to read sensitive mail.5.9CVE-2017-176899foldersnine+22
EPSS score
4.22%
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.5.9CVE-2017-17688applemail+12
EPSS score
5.55%
The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature or accept an obsolete packet type, not a problem in the OpenPGP specification