Gnome
Gnome Evolution: vulnerabilidades y CVE
Gnome Evolution tiene 21 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE21
Últimos 12 meses0
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2009-3721 | Alta (7.8) | 1.6% | — | 26 may 2021 | Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived from yTNEF. A crafted email could cause these applications to write data in… |
| CVE-2021-3349 | Baja (3.3) | 0.35% | — | 1 feb 2021 | GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties… |
| CVE-2020-11879 | Media (6.5) | 2.8% | — | 17 abr 2020 | An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or… |
| CVE-2013-4166 | Alta (7.5) | 1.9% | — | 6 feb 2020 | The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which… |
| CVE-2018-15587 | Media (6.5) | 2.4% | — | 11 feb 2019 | GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment. |
| CVE-2016-10727 | Crítica (9.8) | 2.9% | — | 20 jul 2018 | camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will… |
| CVE-2018-12422 | Crítica (9.8) | 1.8% | — | 15 jun 2018 | addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function.… |
| CVE-2017-17689 | Media (5.9) | 4.1% | — | 16 may 2018 | The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. |
| CVE-2011-3201 | Media (4.3) | 2.7% | — | 8 mar 2013 | GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email. |
| CVE-2009-1631 | Baja (2.1) | 0.44% | — | 14 may 2009 | The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to… |
| CVE-2008-1108 | Alta (7.6) | 5.7% | — | 4 jun 2008 | Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment. |
| CVE-2008-1109 | Alta (9.3) | 5.7% | — | 4 jun 2008 | Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in… |
| CVE-2008-0072 | Media (6.8) | 6.0% | — | 6 mar 2008 | Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated… |
| CVE-2007-3257 | Media (6.8) | 3.1% | — | 19 jun 2007 | Camel (camel-imap-folder.c) in the mailer component for Evolution Data Server 1.11 allows remote IMAP servers to execute arbitrary code via a negative SEQUENCE value in GData, which is used as an array index. |
| CVE-2007-1266 | Media (5) | 5.0% | — | 6 mar 2007 | Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually distinguishing between signed and unsigned portions of OpenPGP messages with… |
| CVE-2006-2789 | Baja (2.6) | 2.1% | — | 2 jun 2006 | Evolution 2.2.x and 2.3.x in GNOME 2.7 and 2.8, when "load images if sender in addressbook" is enabled, allows remote attackers to cause a denial of service (persistent crash) via a crafted "From" header that triggers… |
| CVE-2006-0040 | Media (5) | 2.0% | — | 10 mar 2006 | GNOME Evolution 2.4.2.1 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a text e-mail with a large number of URLs, possibly due to unknown problems in gtkhtml. |
| CVE-2006-0528 | Media (5) | 11% | — | 2 feb 2006 | The cairo library (libcairo), as used in GNOME Evolution and possibly other products, allows remote attackers to cause a denial of service (persistent client crash) via an attached text file that contains… |
| CVE-2005-2550 | Alta (7.5) | 4.4% | — | 12 ago 2005 | Format string vulnerability in Evolution 1.4 through 2.3.6.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the calendar entries such as task lists, which are not… |
| CVE-2005-2549 | Alta (7.5) | 4.4% | — | 12 ago 2005 | Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data, (2) contact data from… |
| CVE-2005-0102 | Crítica (9.8) | 3.2% | — | 24 ene 2005 | Integer overflow in camel-lock-helper in Evolution 2.0.2 and earlier allows local users or remote malicious POP3 servers to execute arbitrary code via a length value of -1, which leads to a zero byte memory allocation… |