28 results (0.010 seconds)

CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0

CVE-2021-39361

https://notcve.org/view.php?id=CVE-2021-39361

In GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. En GNOME evolution-rss versiones hasta 0.3.96, el archivo network-soup.c, no habilita la verificación del certificado TLS en los objetos SoupSessionSync que crea, dejando a los usuarios vulnerables a ataques MITM de la red. NOTA: Esto es similar a CVE-2016-20011. • https://blogs.gnome.org/mcatanzaro/2021/05/25/reminder-soupsessionsync-and-soupsessionasync-default-to-no-tls-certificate-verification https://gitlab.gnome.org/GNOME/evolution-rss/-/issues/11 • CWE-295: Improper Certificate Validation •

CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2009-3721

https://notcve.org/view.php?id=CVE-2009-3721

Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived from yTNEF. A crafted email could cause these applications to write data in arbitrary locations on the filesystem, crash, or potentially execute arbitrary code when decoding attachments. Se detectaron múltiples vulnerabilidades de salto de directorio y desbordamiento de búfer en yTNEF, y en el analizador TNEF de Evolution que deriva de yTNEF. Un correo electrónico diseñado podría causar que estas aplicaciones escriban datos en ubicaciones arbitrarias en el sistema de archivos, bloqueen, o potencialmente ejecuten código arbitrario cuando se decodifican archivos adjuntos • http://www.ocert.org/advisories/ocert-2009-013.html https://bugzilla.redhat.com/show_bug.cgi?id=521662 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 1

CVE-2021-3349

https://notcve.org/view.php?id=CVE-2021-3349

GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior ** EN DISPUTA ** GNOME Evolution versiones hasta 3.38.3, produce un mensaje "Valid signature" para un identificador desconocido en una clave previamente confiable porque Evolution no recupera suficiente información de la API de GnuPG. NOTA: terceros disputan la importancia de este problema y disputan si Evolution es el mejor lugar para cambiar este comportamiento • https://dev.gnupg.org/T4735 https://gitlab.gnome.org/GNOME/evolution/-/issues/299 https://mgorny.pl/articles/evolution-uid-trust-extrapolation.html • CWE-345: Insufficient Verification of Data Authenticity •

CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1

CVE-2020-16117 – evolution-data-server: NULL pointer dereference related to imapx_free_capability and imapx_connect_to_server

https://notcve.org/view.php?id=CVE-2020-16117

In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server. En GNOME evolution-data-server versiones anteriores a 3.35.91, un servidor malicioso puede bloquear el cliente de correo con una desreferencia del puntero NULL mediante el envío de una línea CAPABILITY no válida (por ejemplo, mínima) en un intento de conexión. Esto está relacionado con las funciones imapx_free_capability e imapx_connect_to_server A NULL pointer dereference flaw was found in the GNOME evolution-data-server when a mail client parses invalid messages from a malicious server. This flaw allows an attacker who controls a mail server the ability to crash the mail clients. • https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/2cc39592b532cf0dc994fd3694b8e6bf924c9ab5 https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/627c3cdbfd077e59aa288c85ff8272950577f1d7 https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/189 https://lists.debian.org/debian-lts-announce/2020/08/msg00005.html https://access.redhat.com/security/cve/CVE-2020-16117 https://bugzilla.redhat.com/show_bug.cgi?id=1862125 • CWE-476: NULL Pointer Dereference •

CVSS: 5.9EPSS: 0%CPEs: 7EXPL: 1

CVE-2020-14928 – evolution-data-server: Response injection via STARTTLS in SMTP and POP3

https://notcve.org/view.php?id=CVE-2020-14928

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection." evolution-data-server (eds) versiones hasta 3.36.3, presenta un problema de almacenamiento en búfer STARTTLS que afecta a SMTP y POP3. Cuando un servidor envía una respuesta "begin TLS", eds lee datos adicionales y los evalúa en un contexto TLS, también se conoce como "response injection" • https://bugzilla.suse.com/show_bug.cgi?id=1173910 https://gitlab.gnome.org/GNOME//evolution-data-server/commit/ba82be72cfd427b5d72ff21f929b3a6d8529c4df https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/f404f33fb01b23903c2bbb16791c7907e457fbac https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/226 https://lists.debian.org/debian-lts-announce/2020/07/msg00012.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMBEZWA22EAYAZQWUX4KPEBER726KSIG https://sec • CWE-20: Improper Input Validation CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •