In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade evolution-data-server-testsUpgrade evolution-data-server-docUpgrade evolution-data-server-perlUpgrade evolution-devel | May 4, 2022 | Jul 29, 2020 |
| Centos_linux | — | Upgrade evolution-debugsourceUpgrade evolution-ewsUpgrade evolution-data-server-langpacksUpgrade evolution-data-server-debuginfoUpgrade evolution-data-serverUpgrade evolution-bogofilter-debuginfoUpgrade evolution-langpacksUpgrade evolution-spamassassin-debuginfoUpgrade evolutionUpgrade evolution-bogofilterUpgrade evolution-helpUpgrade evolution-pstUpgrade evolution-data-server-debugsourceUpgrade evolution-ews-debugsourceUpgrade evolution-data-server-develUpgrade evolution-spamassassinUpgrade evolution-debuginfoUpgrade evolution-ews-langpacksUpgrade evolution-ews-debuginfoUpgrade evolution-pst-debuginfoUpgrade evolution-data-server-tests-debuginfo | Jun 1, 2021 | Jul 29, 2020 |
| Debian | — | Upgrade evolution-data-server | Aug 4, 2020 | Jul 29, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade evolution-data-serverUpgrade evolution-data-server-devel | Feb 22, 2021 | Jul 29, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade evolution-data-server-develUpgrade evolution-data-server | Jan 20, 2021 | Jul 29, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade evolution-data-server-develUpgrade evolution-data-server | Nov 2, 2020 | Jul 29, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade evolution-data-server-langpacksUpgrade evolution-data-serverUpgrade evolution-data-server-devel | Aug 31, 2020 | Jul 29, 2020 |
| Oracle Solaris | — | Upgrade library/desktop/evolution-data-server to version 3.34.0-11.4.27.0.1.82.0 on Solaris 11.4 | Jan 19, 2021 | Jul 29, 2020 |
| Oracle_linux | — | Upgrade evolution-data-server-langpacksUpgrade evolution-ews-langpacksUpgrade evolution-bogofilterUpgrade evolution-ewsUpgrade evolution-data-server-perlUpgrade evolution-helpUpgrade evolution-data-server-docUpgrade evolution-spamassassinUpgrade evolution-data-serverUpgrade evolutionUpgrade evolution-data-server-develUpgrade evolution-develUpgrade evolution-pstUpgrade evolution-data-server-testsUpgrade evolution-langpacks | May 26, 2021 | Jul 30, 2020 |
| Redhat_linux | — | Upgrade evolution-spamassassinUpgrade evolution-develUpgrade evolution-debuginfoNo solution existsUpgrade evolution-ews-debuginfoUpgrade evolution-data-server-testsUpgrade evolution-data-server-debugsourceUpgrade evolution-pstUpgrade evolution-pst-debuginfoUpgrade evolution-langpacksUpgrade evolution-data-server-tests-debuginfoUpgrade evolutionUpgrade evolution-ews-debugsourceUpgrade evolution-data-serverUpgrade evolution-debugsourceUpgrade evolution-data-server-docUpgrade evolution-data-server-debuginfoUpgrade evolution-data-server-langpacksUpgrade evolution-bogofilter-debuginfoUpgrade evolution-ewsUpgrade evolution-data-server-develUpgrade evolution-bogofilterUpgrade evolution-helpUpgrade evolution-spamassassin-debuginfoUpgrade evolution-data-server-perlUpgrade evolution-ews-langpacks | May 21, 2021 | Jul 29, 2020 |
| Rocky_linux | — | Upgrade evolution-bogofilter-debuginfoUpgrade evolution-data-server-develUpgrade evolution-bogofilterUpgrade evolution-data-server-perlUpgrade evolution-pstUpgrade evolution-data-serverUpgrade evolution-data-server-debuginfoUpgrade evolution-ews-debugsourceUpgrade evolution-debugsourceUpgrade evolutionUpgrade evolution-ews-debuginfoUpgrade evolution-debuginfoUpgrade evolution-data-server-debugsourceUpgrade evolution-spamassassin-debuginfoUpgrade evolution-develUpgrade evolution-spamassassinUpgrade evolution-pst-debuginfoUpgrade evolution-ewsUpgrade evolution-data-server-tests-debuginfoUpgrade evolution-data-server-tests | Mar 12, 2024 | Jul 29, 2020 |
| Suse | — | Upgrade libedataserver-1_2-22Upgrade libecal-1_2-19Upgrade libedataserverui-1_2-1Upgrade evolution-ewsUpgrade libebook-1_2-20-32bitUpgrade libcamel-1_2-62Upgrade evolution-ews-langUpgrade typelib-1_0-EDataServerUI-1_2Upgrade libcamel-1_2-59-32bitUpgrade libcamel-1_2-59Upgrade libecal-2_0-1-32bitUpgrade libedata-book-1_2-26Upgrade libecal-2_0-1Upgrade libebackend-1_2-10Upgrade libebook-contacts-1_2-3-32bitUpgrade evolution-data-server-32bitUpgrade libebook-1_2-16Upgrade libedata-cal-2_0-1-32bitUpgrade libcamel-1_2-57Upgrade libebook-1_2-16-32bitUpgrade libedataserver-1_2-22-32bitUpgrade typelib-1_0-EDataServer-1_2Upgrade libebook-contacts-1_2-2-32bitUpgrade libecal-1_2-19-32bitUpgrade libedataserver-1_2-24-32bitUpgrade evolution-data-server-develUpgrade libedataserverui-1_2-2Upgrade evolution-data-server-langUpgrade libedata-book-1_2-25Upgrade libebook-1_2-20Upgrade libedata-cal-1_2-28-32bitUpgrade libedataserverui-1_2-2-32bitUpgrade typelib-1_0-EBook-1_2Upgrade evolution-data-serverUpgrade typelib-1_0-EDataCal-2_0Upgrade typelib-1_0-EDataBook-1_2Upgrade libedataserver-1_2-24Upgrade typelib-1_0-Camel-1_2Upgrade libedata-book-1_2-25-32bitUpgrade libcamel-1_2-62-32bitUpgrade libedata-cal-1_2-28Upgrade libebook-contacts-1_2-2Upgrade libedata-book-1_2-26-32bitUpgrade typelib-1_0-EBookContacts-1_2Upgrade libebook-contacts-1_2-3Upgrade typelib-1_0-ECal-2_0Upgrade libebackend-1_2-10-32bitUpgrade libedataserver-1_2-21Upgrade libedata-cal-2_0-1Upgrade typelib-1_0-EBackend-1_2 | Mar 20, 2021 | Jul 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub