--- title: "CVE-2007-1558\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2007-1558?format=md keywords: index, follow --- # CVE-2007-1558 Publication date 16 April 2007 Last updated 17 July 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4, (2) Evolution, (3) mutt, (4) fetchmail before 6.3.8, (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2, (6) Balsa 2.3.16 and earlier, (7) Mailfilter before 0.8.2, and possibly other products. [Read the notes from the security team](https://ubuntu.com/security/CVE-2007-1558?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | fetchmail | 7.04 feisty | Fixed 6.3.6-1ubuntu2.1 | | 6.10 edgy | Fixed 6.3.4-1ubuntu4.2 | | 6.06 LTS dapper | Fixed 6.3.2-2ubuntu2.2 | | iceape | 7.04 feisty | Not in release | | 6.10 edgy | Not in release | | 6.06 LTS dapper | Not in release | | im | 7.04 feisty | Ignored | | 6.10 edgy | Ignored | | 6.06 LTS dapper | Ignored | | mew | 7.04 feisty | Ignored | | 6.10 edgy | Ignored | | 6.06 LTS dapper | Ignored | | mew-beta | 7.04 feisty | Ignored | | 6.10 edgy | Ignored | | 6.06 LTS dapper | Ignored | | mozilla-thunderbird | 7.04 feisty | Fixed 1.5.0.13-0ubuntu0.7.04 | | 6.10 edgy | Fixed 1.5.0.13-0ubuntu0.6.10 | | 6.06 LTS dapper | Fixed 1.5.0.13-0ubuntu0.6.06 | | wl | 7.04 feisty | Ignored | | 6.10 edgy | Ignored | | 6.06 LTS dapper | Ignored | | wl-beta | 7.04 feisty | Ignored | | 6.10 edgy | Ignored | | 6.06 LTS dapper | Ignored | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Notes --- ### [kees](https://launchpad.net/~kees) This is a partial attack, not really feasible, so it okay to ignore. --- ### [jdstrand](https://launchpad.net/~jdstrand) possible fetchmail patch at http://www.securityfocus.com/archive/1/464477/30/0/threaded ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2007-1558) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2007-1558) * [Debian](https://security-tracker.debian.org/tracker/CVE-2007-1558) ### Related Ubuntu Security Notices (USN) + [USN-520-1](https://usn.ubuntu.com/USN-520-1) + fetchmail vulnerabilities + 26 September 2007 + [USN-469-1](https://usn.ubuntu.com/USN-469-1) + Thunderbird vulnerabilities + 6 June 2007 ### Other references * *