In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade evolution-data-server-perlUpgrade evolution-data-server-docUpgrade evolution-data-server-testsUpgrade evolution-devel | May 4, 2022 | Jul 29, 2020 |
| Centos_linux | — | Upgrade evolution-ews-debugsourceUpgrade evolution-pst-debuginfoUpgrade evolution-data-server-develUpgrade evolution-ews-langpacksUpgrade evolution-data-server-debugsourceUpgrade evolution-ews-debuginfoUpgrade evolution-spamassassinUpgrade evolution-data-server-tests-debuginfoUpgrade evolution-pstUpgrade evolution-debuginfoUpgrade evolution-bogofilterUpgrade evolution-bogofilter-debuginfoUpgrade evolution-langpacksUpgrade evolution-data-server-langpacksUpgrade evolutionUpgrade evolution-ewsUpgrade evolution-spamassassin-debuginfoUpgrade evolution-debugsourceUpgrade evolution-data-server-debuginfoUpgrade evolution-data-serverUpgrade evolution-help | Jun 1, 2021 | Jul 29, 2020 |
| Debian | — | Upgrade evolution-data-server | Aug 4, 2020 | Jul 29, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade evolution-data-server-develUpgrade evolution-data-server | Feb 22, 2021 | Jul 29, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade evolution-data-serverUpgrade evolution-data-server-devel | Jan 20, 2021 | Jul 29, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade evolution-data-serverUpgrade evolution-data-server-devel | Nov 2, 2020 | Jul 29, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade evolution-data-server-langpacksUpgrade evolution-data-server-develUpgrade evolution-data-server | Aug 31, 2020 | Jul 29, 2020 |
| Oracle Solaris | — | Upgrade library/desktop/evolution-data-server to version 3.34.0-11.4.27.0.1.82.0 on Solaris 11.4 | Jan 19, 2021 | Jul 29, 2020 |
| Oracle_linux | — | Upgrade evolution-helpUpgrade evolution-bogofilterUpgrade evolution-ewsUpgrade evolution-data-server-perlUpgrade evolution-data-server-langpacksUpgrade evolution-ews-langpacksUpgrade evolution-data-server-develUpgrade evolution-pstUpgrade evolution-data-server-testsUpgrade evolution-data-server-docUpgrade evolution-develUpgrade evolution-langpacksUpgrade evolution-data-serverUpgrade evolution-spamassassinUpgrade evolution | May 26, 2021 | Jul 30, 2020 |
| Redhat_linux | — | Upgrade evolution-data-server-testsUpgrade evolution-pstUpgrade evolution-ews-debuginfoUpgrade evolution-debuginfoUpgrade evolution-ews-debugsourceUpgrade evolution-langpacksUpgrade evolution-pst-debuginfoUpgrade evolution-spamassassinUpgrade evolution-data-server-debugsourceUpgrade evolution-data-server-tests-debuginfoUpgrade evolutionNo solution existsUpgrade evolution-develUpgrade evolution-data-serverUpgrade evolution-helpUpgrade evolution-debugsourceUpgrade evolution-data-server-perlUpgrade evolution-ewsUpgrade evolution-data-server-debuginfoUpgrade evolution-data-server-develUpgrade evolution-ews-langpacksUpgrade evolution-spamassassin-debuginfoUpgrade evolution-data-server-langpacksUpgrade evolution-bogofilter-debuginfoUpgrade evolution-bogofilterUpgrade evolution-data-server-doc | May 21, 2021 | Jul 29, 2020 |
| Rocky_linux | — | Upgrade evolution-develUpgrade evolution-ews-debuginfoUpgrade evolutionUpgrade evolution-ewsUpgrade evolution-debugsourceUpgrade evolution-spamassassin-debuginfoUpgrade evolution-ews-debugsourceUpgrade evolution-data-server-tests-debuginfoUpgrade evolution-data-server-testsUpgrade evolution-data-server-debuginfoUpgrade evolution-spamassassinUpgrade evolution-pst-debuginfoUpgrade evolution-debuginfoUpgrade evolution-data-server-debugsourceUpgrade evolution-pstUpgrade evolution-bogofilterUpgrade evolution-data-server-perlUpgrade evolution-bogofilter-debuginfoUpgrade evolution-data-serverUpgrade evolution-data-server-devel | Mar 12, 2024 | Jul 29, 2020 |
| Suse | — | Upgrade libedata-cal-1_2-28Upgrade libedata-book-1_2-25Upgrade libedata-cal-1_2-28-32bitUpgrade libebook-1_2-20Upgrade libebook-contacts-1_2-2Upgrade typelib-1_0-Camel-1_2Upgrade typelib-1_0-EDataBook-1_2Upgrade libedataserver-1_2-21Upgrade evolution-data-serverUpgrade libedata-book-1_2-25-32bitUpgrade libcamel-1_2-62-32bitUpgrade typelib-1_0-EBook-1_2Upgrade typelib-1_0-EDataCal-2_0Upgrade libebackend-1_2-10-32bitUpgrade libedata-cal-2_0-1Upgrade libedata-book-1_2-26-32bitUpgrade libebook-contacts-1_2-3Upgrade libedataserver-1_2-24Upgrade typelib-1_0-EBackend-1_2Upgrade typelib-1_0-EBookContacts-1_2Upgrade typelib-1_0-ECal-2_0Upgrade libedataserverui-1_2-2-32bitUpgrade evolution-data-server-langUpgrade libedata-cal-2_0-1-32bitUpgrade libcamel-1_2-57Upgrade libecal-1_2-19Upgrade libedataserverui-1_2-2Upgrade libedataserver-1_2-24-32bitUpgrade libedataserver-1_2-22-32bitUpgrade libebook-1_2-16-32bitUpgrade typelib-1_0-EDataServer-1_2Upgrade libebook-contacts-1_2-2-32bitUpgrade libedataserverui-1_2-1Upgrade libebook-1_2-20-32bitUpgrade evolution-ewsUpgrade libedataserver-1_2-22Upgrade libedata-book-1_2-26Upgrade evolution-data-server-develUpgrade libebackend-1_2-10Upgrade evolution-ews-langUpgrade libecal-2_0-1Upgrade libcamel-1_2-62Upgrade typelib-1_0-EDataServerUI-1_2Upgrade libecal-2_0-1-32bitUpgrade libebook-contacts-1_2-3-32bitUpgrade libebook-1_2-16Upgrade libcamel-1_2-59Upgrade evolution-data-server-32bitUpgrade libecal-1_2-19-32bitUpgrade libcamel-1_2-59-32bit | Mar 20, 2021 | Jul 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub