CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2020-16117 – evolution-data-server: NULL pointer dereference related to imapx_free_capability and imapx_connect_to_server
https://notcve.org/view.php?id=CVE-2020-16117
In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server. En GNOME evolution-data-server versiones anteriores a 3.35.91, un servidor malicioso puede bloquear el cliente de correo con una desreferencia del puntero NULL mediante el envío de una línea CAPABILITY no válida (por ejemplo, mínima) en un intento de conexión. Esto está relacionado con las funciones imapx_free_capability e imapx_connect_to_server A NULL pointer dereference flaw was found in the GNOME evolution-data-server when a mail client parses invalid messages from a malicious server. This flaw allows an attacker who controls a mail server the ability to crash the mail clients. • https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/2cc39592b532cf0dc994fd3694b8e6bf924c9ab5 https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/627c3cdbfd077e59aa288c85ff8272950577f1d7 https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/189 https://lists.debian.org/debian-lts-announce/2020/08/msg00005.html https://access.redhat.com/security/cve/CVE-2020-16117 https://bugzilla.redhat.com/show_bug.cgi?id=1862125 • CWE-476: NULL Pointer Dereference •
CVSS: 5.9EPSS: 0%CPEs: 7EXPL: 1CVE-2020-14928 – evolution-data-server: Response injection via STARTTLS in SMTP and POP3
https://notcve.org/view.php?id=CVE-2020-14928
evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection." evolution-data-server (eds) versiones hasta 3.36.3, presenta un problema de almacenamiento en búfer STARTTLS que afecta a SMTP y POP3. Cuando un servidor envía una respuesta "begin TLS", eds lee datos adicionales y los evalúa en un contexto TLS, también se conoce como "response injection" • https://bugzilla.suse.com/show_bug.cgi?id=1173910 https://gitlab.gnome.org/GNOME//evolution-data-server/commit/ba82be72cfd427b5d72ff21f929b3a6d8529c4df https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/f404f33fb01b23903c2bbb16791c7907e457fbac https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/226 https://lists.debian.org/debian-lts-announce/2020/07/msg00012.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMBEZWA22EAYAZQWUX4KPEBER726KSIG https://sec • CWE-20: Improper Input Validation CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2009-0582 – evolution-data-server: insufficient checking of NTLM authentication challenge packets
https://notcve.org/view.php?id=CVE-2009-0582
The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data. La función ntlm_challenge en el mecanismo de autenticación NTLM SASL de camel/camel-sasl-ntlm.c en Camel en Evolution Data Server (alias evolution-data-server) 2.24.5 y anteriores, and 2.25.92 and earlier 2.25.x , no valida si cierto valor de longitud es coherente con la cantidad de datos almacenados en el paquete del desafío, lo cual permite leer, a los servidores de correo remotos, información de la memoria del proceso de un cliente, o provocar una denegación de servicio (con caida del cliente), a través de una autenticación NTLM autenticación de tipo 2 con un valor de longitud del paquete que supera la cantidad de paquetes de datos. • http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html http://mail.gnome.org/archives/release-team/2009-March/msg00096.html http://osvdb.org/52673 http://secunia.com/advisories/34286 http://secunia.com/advisories/34338 http://secunia.com/advisories/34339 http://secunia.com/advisories/34348 http://secunia.com/advisories/34363 http://secunia.com/advisories/35065 http://secunia.com/advisories/35357 http://securitytracker.com/id?1021845 http://www.debian.org&#x • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2009-0587 – evolution-data-server: integer overflow in base64 encoding functions
https://notcve.org/view.php?id=CVE-2009-0587
Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel. Múltiples desbordamientos de enteros en Evolution Data Server (alias Evolution-Data-Server) antes de la version 2.24.5 permiten a atacantes dependientes de contexto ejecutar código arbitrario a través de una cadena demasiado larga que es convertida en una representación en base64 en (1) addressbook/libebook/e-vcard.c en evc o (2) camel/camel-mime-utils.c en libcamel. • http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html http://ocert.org/patches/2008-015/camel-CVE-2009-0587.diff http://ocert.org/patches/2008-015/evc-CVE-2009-0587.diff http://openwall.com/lists/oss-security/2009/03/12/2 http://osvdb.org/52702 http://osvdb.org/52703 http://secunia.com/advisories/34338 http://secunia.com/advisories/34339 http://secunia.com/advisories/34348 http://secunia.com/advisories/34351 http://secunia.com/advisories/ • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •