// For flags

CVE-2008-0072

Evolution format string flaw

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.

Una vulnerabilidad de cadena de formato en la función emf_multipart_encrypted en el archivo mail/em-format.c en Evolution versión 2.12.3 y anteriores, permite a atacantes remotos ejecutar código arbitrario por medio de un mensaje encriptado diseñado, tal y como es demostrado usando el campo Version.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-01-03 CVE Reserved
  • 2008-03-06 CVE Published
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-134: Use of Externally-Controlled Format String
CAPEC
References (30)
URL Tag Source
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0105 X_refsource_confirm
http://www.kb.cert.org/vuls/id/512491 Third Party Advisory
http://www.securityfocus.com/archive/1/492684/100/0/threaded Mailing List
http://www.securityfocus.com/bid/28102 Vdb Entry
http://www.securitytracker.com/id?1019540 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/41011 Vdb Entry
https://issues.rpath.com/browse/RPL-2310 X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10701 Signature
URL Date SRC
URL Date SRC
http://www.debian.org/security/2008/dsa-1512 2018-10-15
URL Date SRC
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00003.html 2018-10-15
http://secunia.com/advisories/29057 2018-10-15
http://secunia.com/advisories/29163 2018-10-15
http://secunia.com/advisories/29210 2018-10-15
http://secunia.com/advisories/29244 2018-10-15
http://secunia.com/advisories/29258 2018-10-15
http://secunia.com/advisories/29264 2018-10-15
http://secunia.com/advisories/29317 2018-10-15
http://secunia.com/advisories/30437 2018-10-15
http://secunia.com/advisories/30491 2018-10-15
http://secunia.com/secunia_research/2008-8/advisory 2018-10-15
http://security.gentoo.org/glsa/glsa-200803-12.xml 2018-10-15
http://www.mandriva.com/security/advisories?name=MDVSA-2008:063 2018-10-15
http://www.redhat.com/support/errata/RHSA-2008-0177.html 2018-10-15
http://www.redhat.com/support/errata/RHSA-2008-0178.html 2018-10-15
http://www.ubuntu.com/usn/usn-583-1 2018-10-15
http://www.vupen.com/english/advisories/2008/0768/references 2018-10-15
https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00190.html 2018-10-15
https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00195.html 2018-10-15
https://access.redhat.com/security/cve/CVE-2008-0072 2008-03-05
https://bugzilla.redhat.com/show_bug.cgi?id=435759 2008-03-05
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Gnome
Search vendor "Gnome"
 Evolution
Search vendor "Gnome" for product "Evolution"
 <= 2.12.3
Search vendor "Gnome" for product "Evolution" and version " <= 2.12.3"
-
Affected
in Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
*-
Safe