CVE catalog

CVE-2020-15954

kdepim-runtime: CVE-2020-15954

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.65% · Oct 25, 2026

KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianksmtpsid26.08.2-2fixed
Debianksmtpforky26.04.3-2fixed
Debianksmtptrixie24.12.3-1fixed
Debianksmtpbookworm22.12.3-1fixed
Debiankdepim-runtimesid4:26.08.2-2fixed
Debiankdepim-runtimeforky4:26.04.3-2fixed
Debiankdepim-runtimetrixie4:24.12.3-1fixed
Debiankdepim-runtimebookworm4:22.12.3-1fixed
Debiankmail-account-wizardsid4:26.08.2-2fixed
Debiankmail-account-wizardforky4:26.04.3-2fixed
Debiankmail-account-wizardtrixie4:24.12.3-1+deb13u1fixed
Debiankmail-account-wizardbookworm4:22.12.3-1+deb12u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianksmtpsourcesid21.12.3-2not yet assignedNot reportedNot reported
Debianksmtpsourceforky21.12.3-2not yet assignedNot reportedNot reported
Debianksmtpsourcetrixie21.12.3-2not yet assignedNot reportedNot reported
Debianksmtpsourcebookworm21.12.3-2not yet assignedNot reportedNot reported
Debiankdepim-runtimesourcesid4:20.04.1-2not yet assignedNot reported[966666]
Debiankdepim-runtimesourceforky4:20.04.1-2not yet assignedNot reported[966666]
Debiankdepim-runtimesourcetrixie4:20.04.1-2not yet assignedNot reported[966666]
Debiankdepim-runtimesourcebookworm4:20.04.1-2not yet assignedNot reported[966666]
Debiankmail-account-wizardsourcesid4:20.04.1-2not yet assignedNot reported[966667]
Debiankmail-account-wizardsourceforky4:20.04.1-2not yet assignedNot reported[966667]
Debiankmail-account-wizardsourcetrixie4:20.04.1-2not yet assignedNot reported[966667]
Debiankmail-account-wizardsourcebookworm4:20.04.1-2not yet assignedNot reported[966667]

[Debian bug #966666][Debian bug #966667]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [accountwizard]Fixed

    Source package: [kmail-account-wizard]

    Details (2)

    • 4:22.12.3-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4:20.04.1-2

      dsa · kmail-account-wizard · debian · bookworm; dsa · kmail-account-wizard · debian · 12

    • 4:22.12.3-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4:20.04.1-2

      dsa · kmail-account-wizard · debian · bookworm; dsa · kmail-account-wizard · debian · 12

  • [kdepim-runtime]Fixed
    Details (2)

    • 4:22.12.3-1 · amd64 · bookworm

      Fixed · Fixed: 4:20.04.1-2

      dsa · kdepim-runtime · debian · bookworm; dsa · kdepim-runtime · debian · 12

    • 4:22.12.3-1 · arm64 · bookworm

      Fixed · Fixed: 4:20.04.1-2

      dsa · kdepim-runtime · debian · bookworm; dsa · kdepim-runtime · debian · 12

  • [libkpimsmtp5abi1]Fixed

    Source package: [ksmtp]

    Details (2)

    • 22.12.3-1 · amd64 · bookworm

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · bookworm; dsa · ksmtp · debian · 12

    • 22.12.3-1 · arm64 · bookworm

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · bookworm; dsa · ksmtp · debian · 12

  • [libkpimsmtp-data]Fixed

    Source package: [ksmtp]

    Details (2)

    • 22.12.3-1 · all · bookworm

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · bookworm; dsa · ksmtp · debian · 12

    • 22.12.3-1 · all · bookworm

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · bookworm; dsa · ksmtp · debian · 12

  • [libkpimsmtp-dev]Fixed

    Source package: [ksmtp]

    Details (2)

    • 22.12.3-1 · amd64 · bookworm

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · bookworm; dsa · ksmtp · debian · 12

    • 22.12.3-1 · arm64 · bookworm

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · bookworm; dsa · ksmtp · debian · 12

[Debian 13 (Trixie)]

  • [accountwizard]Fixed

    Source package: [kmail-account-wizard]

    Details (2)

    • 4:24.12.3-1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 4:20.04.1-2

      dsa · kmail-account-wizard · debian · 13

    • 4:24.12.3-1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 4:20.04.1-2

      dsa · kmail-account-wizard · debian · 13

  • [kdepim-runtime]Fixed
    Details (2)

    • 4:24.12.3-1 · amd64 · trixie

      Fixed · Fixed: 4:20.04.1-2

      dsa · kdepim-runtime · debian · 13

    • 4:24.12.3-1 · arm64 · trixie

      Fixed · Fixed: 4:20.04.1-2

      dsa · kdepim-runtime · debian · 13

  • [libkpim6smtp6]Fixed

    Source package: [ksmtp]

    Details (2)

    • 24.12.3-1 · amd64 · trixie

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · 13

    • 24.12.3-1 · arm64 · trixie

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · 13

  • [libksmtp-data]Fixed

    Source package: [ksmtp]

    Details (2)

    • 24.12.3-1 · all · trixie

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · 13

    • 24.12.3-1 · all · trixie

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · 13

  • [libksmtp-dev]Fixed

    Source package: [ksmtp]

    Details (2)

    • 24.12.3-1 · amd64 · trixie

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · 13

    • 24.12.3-1 · arm64 · trixie

      Fixed · Fixed: 21.12.3-2

      dsa · ksmtp · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]