blob: b69d90902fdbad05600cd7cad9d37ed6466efe0d [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200803-12">
<title>Evolution: Format string vulnerability</title>
A format string error has been discovered in Evolution, possibly resulting
in the execution of arbitrary code.
<product type="ebuild">evolution</product>
<announced>March 05, 2008</announced>
<revised>March 05, 2008: 01</revised>
<package name="mail-client/evolution" auto="yes" arch="*">
<unaffected range="ge">2.12.3-r1</unaffected>
<vulnerable range="lt">2.12.3-r1</vulnerable>
Evolution is a GNOME groupware application.
Ulf Harnhammar from Secunia Research discovered a format string error
in the emf_multipart_encrypted() function in the file mail/em-format.c
when reading certain data (e.g. the "Version:" field) from an encrypted
<impact type="normal">
A remote attacker could entice a user to open a specially crafted
encrypted e-mail, potentially resulting in the execution of arbitrary
code with the privileges of the user running Evolution.
There is no known workaround at this time.
All Evolution users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=mail-client/evolution-2.12.3-r1&quot;</code>
<uri link="">CVE-2008-0072</uri>
<metadata tag="requester" timestamp="Wed, 05 Mar 2008 20:09:16 +0000">
<metadata tag="submitter" timestamp="Wed, 05 Mar 2008 21:00:40 +0000">
<metadata tag="bugReady" timestamp="Wed, 05 Mar 2008 21:00:49 +0000">