Airmail 3 for Mac Advisory:EventHandler Race Condition: CVE-2018-15670

Home | Research | Resources | Advisories | Airmail 3 for Mac

Airmail 3 for Mac

EventHandler Race Condition

CVE ID

CVE-2018-15670

VENDOR

Bloop S.R.L.

PRODUCT

Airmail 3 for Mac

Product version

3.5.9

Vulnerability Details

Airmail's primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that "OpenURL" is the default URL handler. A navigation request is processed by the default URL handler only if the "currentEvent" is "NX_LMOUSEUP" or "NX_OMOUSEUP". An attacker may abuse HTML Elements with an EventHandler for a chance to validate navigation requests for URLs that are processed during the "NX_LMOUSEUP" event triggered by clicking an email.

Learn More →

Vendor response

No response.

Disclosure timeline

08-06-2018 - Vendor disclosure via email
08-13-2018 - Vendor notified via Support Page
08-21-2018 - Vendor notified of the advisory release

Why Bad Guys do Bad Things:

Blog Post

Web Application Security

In this briefing, VerSprite’s Threat Intelligence Team covers “Why Bad Guys do Bad Things?” and why Threat Intelligence Analysts should possess the knowledge of who threat actors are and what drives their criminality.

Analyzing the State of Cybersecurity

Blog Post

PASTA

In this blog, we look back at how the cybersecurity landscape has drastically changed in 2022, what influenced the uptick in cybercrime, and what you need to be aware of to better prepare for the coming year. Our Envisions is a leading threat report, produced by the VerSprite team of cybersecurity analysts, that encompasses cyber trends and geopolitical themes to provide the best expert overview of the state of cybersecurity.

A Look at RACI Models within Application Threat Modeling

Blog Post

Web Application Security

In this model, you will see engineers, network professionals, developers, architects, business analysts, project managers, security champions, pentesters, and quality assurance engineers. Because they all have some level of involvement and collaboration at different stages of application, as well as organizational, threat modeling ensures effective results.

We are an international squad of professionals working as one.

[email protected]