// For flags

CVE-2008-1108

evolution: iCalendar buffer overflow via large timezone specification

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment.

Desbordamiento de búfer en Evolution 2.22.1, cuando el plugin ITip Formates está desactivado, permite a atacantes remotos ejecutar código arbitrario a través de una cadena "timezone" larga en un adjunto iCalendar.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-02-29 CVE Reserved
  • 2008-06-04 CVE Published
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (26)
URL Tag Source
http://secunia.com/advisories/30527 Third Party Advisory
http://secunia.com/advisories/30536 Third Party Advisory
http://secunia.com/advisories/30564 Third Party Advisory
http://secunia.com/advisories/30571 Third Party Advisory
http://secunia.com/advisories/30702 Third Party Advisory
http://secunia.com/advisories/30716 Third Party Advisory
http://secunia.com/secunia_research/2008-22/advisory X_refsource_misc
http://www.securityfocus.com/bid/29527 Vdb Entry
http://www.securitytracker.com/id?1020169 Vdb Entry
http://www.vupen.com/english/advisories/2008/1732/references Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/42824 Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10471 Signature
URL Date SRC
URL Date SRC
URL Date SRC
http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00003.html 2017-09-29
http://secunia.com/advisories/30298 2017-09-29
http://security.gentoo.org/glsa/glsa-200806-06.xml 2017-09-29
http://www.mandriva.com/security/advisories?name=MDVSA-2008:111 2017-09-29
http://www.redhat.com/support/errata/RHSA-2008-0514.html 2017-09-29
http://www.redhat.com/support/errata/RHSA-2008-0515.html 2017-09-29
http://www.redhat.com/support/errata/RHSA-2008-0516.html 2017-09-29
http://www.redhat.com/support/errata/RHSA-2008-0517.html 2017-09-29
http://www.ubuntu.com/usn/usn-615-1 2017-09-29
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00157.html 2017-09-29
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00178.html 2017-09-29
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00179.html 2017-09-29
https://access.redhat.com/security/cve/CVE-2008-1108 2008-06-04
https://bugzilla.redhat.com/show_bug.cgi?id=448540 2008-06-04
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Gnome
Search vendor "Gnome"
 Evolution
Search vendor "Gnome" for product "Evolution"
 2.2.1
Search vendor "Gnome" for product "Evolution" and version "2.2.1"
-
Affected