CVE catalog

CVE-2019-10732

kf5-messagelib affected and fixed versions

In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, they unknowingly leak the plaintext of the encrypted message part(s) back to the attacker.

Severity: Medium · CVSS 5.7CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Published: Feb 22, 2019, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.65% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debianbookworm	kf5-messagelib	`4:19.08.3-1`	FixedDistribution-reported fixed boundary	[CVE-2019-10732]
Debianbookworm	kf5-messagelib	`4:22.12.3-2~deb12u1`	Fixed	[CVE-2019-10732]

Showing 2 fix observations. All 18 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	kf5-messagelib	`4:19.08.3-1`	FixedDistribution-reported fixed boundary	[CVE-2019-10732]
Debianbookworm	kf5-messagelib	`4:22.12.3-2~deb12u1`	Fixed	[CVE-2019-10732]
Opensuseleap 15.1	messagelib	`18.12.3-lp151.2.4.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2021:0188-1]Feb 4, 2026, 4:07:45 AM UTC
Opensusetumbleweed	messagelib	`21.08.1-1.2`	UnknownSource applicability is not established	[OPENSUSE-SU-2024:11046-1]Feb 4, 2026, 4:24:21 AM UTC
Susepackage hub 15 sp1	messagelib	`18.12.3-bp151.3.3.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2021:0227-1]Feb 4, 2026, 2:48:13 AM UTC
Ubuntupro	kdepim	`4:15.08.2-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kdepim	`4:15.12.1-1ubuntu6`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kdepim	`4:15.12.3-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kdepim	`4:15.12.3-0ubuntu1.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kdepim	`4:15.12.3-0ubuntu1.1+esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kf5-messagelib	`4:17.04.3-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kf5-messagelib	`4:17.04.3-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kf5-messagelib	`4:17.08.3-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kf5-messagelib	`4:17.08.3-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kf5-messagelib	`4:17.12.2-0ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kf5-messagelib	`4:17.12.3-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kf5-messagelib	`4:17.12.3-0ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC
Ubuntupro	kf5-messagelib	`4:17.12.3-0ubuntu3+esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-10732]Apr 22, 2026, 12:06:26 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "kf5-messagelib",
      "status": "fixed",
      "release": "bookworm",
      "version": "4:22.12.3-2~deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 926996,
      "name": "kf5-messagelib",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "4:19.08.3-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "kdepim",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4:15.12.3-0ubuntu1.1+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "4:15.08.2-0ubuntu1",
        "4:15.12.1-1ubuntu6",
        "4:15.12.3-0ubuntu1",
        "4:15.12.3-0ubuntu1.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-10732",
      "fixed_version": "4:15.12.3-0ubuntu1.1+esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-10732",
      "provider_updated_at": "2026-04-22T12:06:26.579270Z",
      "applicability_unknown": true
    },
    {
      "name": "kf5-messagelib",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4:17.12.3-0ubuntu3+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "4:17.04.3-0ubuntu1",
        "4:17.04.3-0ubuntu2",
        "4:17.08.3-0ubuntu1",
        "4:17.08.3-0ubuntu2",
        "4:17.12.2-0ubuntu3",
        "4:17.12.3-0ubuntu2",
        "4:17.12.3-0ubuntu3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-10732",
      "fixed_version": "4:17.12.3-0ubuntu3+esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-10732",
      "provider_updated_at": "2026-04-22T12:06:26.579270Z",
      "applicability_unknown": true
    },
    {
      "name": "messagelib",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "21.08.1-1.2"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:11046-1",
      "fixed_version": "21.08.1-1.2",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:11046-1",
      "provider_updated_at": "2026-02-04T04:24:21.001544Z",
      "applicability_unknown": true
    },
    {
      "name": "messagelib",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.12.3-lp151.2.4.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2021:0188-1",
      "fixed_version": "18.12.3-lp151.2.4.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2021:0188-1",
      "provider_updated_at": "2026-02-04T04:07:45.480767Z",
      "applicability_unknown": true
    },
    {
      "name": "messagelib",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.12.3-bp151.3.3.1"
            }
          ]
        }
      ],
      "release": "package hub 15 sp1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2021:0227-1",
      "fixed_version": "18.12.3-bp151.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2021:0227-1",
      "provider_updated_at": "2026-02-04T02:48:13.591719Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #926996]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[kf5-messagelib-data]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · all · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · all · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5messagecomposer5abi1]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5messagecomposer-dev]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5messagecore5abi1]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5messagecore-dev]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5messagelist5abi1]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5messagelist-dev]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5messageviewer5abi1]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5messageviewer-dev]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5mimetreeparser5abi1]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5mimetreeparser-dev]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5templateparser5]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5templateparser-dev]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5webengineviewer5abi1]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
[libkf5webengineviewer-dev]Unknown
Source package: [kf5-messagelib]
Details (2)
- 4:22.12.3-2~deb12u1 · amd64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12
- 4:22.12.3-2~deb12u1 · arm64 · bookworm
  Fixed · Fixed: 4:19.08.3-1
  dsa · kf5-messagelib · debian · bookworm; dsa · kf5-messagelib · debian · 12

[openSUSE Tumbleweed]

[messagelib]Unknown
Source package: [messagelib]
Details (1)
- 26.08.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 21.08.1-1.2
  dsa · messagelib · opensuse · tumbleweed
[messagelib-devel]Unknown
Source package: [messagelib]
Details (1)
- 26.08.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 21.08.1-1.2
  Version impact unknown
  dsa · messagelib · opensuse · tumbleweed
[messagelib-lang]Unknown
Source package: [messagelib]
Details (1)
- 26.08.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 21.08.1-1.2
  Version impact unknown
  dsa · messagelib · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:38:27 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]