Search CVE reports
1 – 10 of 36 results
Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges.
1 affected package
evolution
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| evolution | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
In GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
1 affected package
evolution-rss
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| evolution-rss | Not in release | Needs evaluation | Needs evaluation | Needs evaluation |
GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the...
1 affected package
evolution
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| evolution | Not affected | Not affected | Not affected | Not affected |
In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related...
1 affected package
evolution-data-server
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| evolution-data-server | Not affected | Not affected | Not affected | Needs evaluation |
Some fixes available 3 of 4
evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."
1 affected package
evolution-data-server
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| evolution-data-server | — | — | Fixed | Fixed |
An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a...
1 affected package
evolution
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| evolution | Not affected | Vulnerable | Vulnerable | Vulnerable |
It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the...
1 affected package
evolution-ews
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| evolution-ews | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
Some fixes available 29 of 32
GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.
2 affected packages
evolution, evolution-data-server
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| evolution | Fixed | Fixed | Fixed | Vulnerable |
| evolution-data-server | Fixed | Fixed | Fixed | Fixed |
addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the...
2 affected packages
evolution, evolution-data-server
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| evolution | — | — | — | Ignored |
| evolution-data-server | — | — | — | Ignored |
Some fixes available 18 of 34
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
5 affected packages
kmail, thunderbird, evolution, kf5-messagelib, kdepim
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| kmail | Not affected | Not affected | Not affected | Vulnerable |
| thunderbird | Fixed | Fixed | Fixed | Fixed |
| evolution | Not affected | Not affected | Not affected | Not affected |
| kf5-messagelib | Not affected | Not affected | Not affected | Vulnerable |
| kdepim | Not in release | Not in release | — | — |