USN-166-1: Evolution vulnerabilities

11 August 2005

evolution vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 5.04
  • Ubuntu 4.10

Software Description

Details

Ulf Harnhammar disovered several format string vulnerabilities in Evolution. By tricking an user into viewing a specially crafted vCard attached to an email, specially crafted contact data from an LDAP server, specially crafted task lists from remote servers, or saving Calendar entries with this malicious task list data, it was possible for an attacker to execute arbitrary code with the privileges of the user running Evolution.

In addition, this update fixes a Denial of Service vulnerability in the mail attachment parser. This could be exploited to crash Evolution by tricking an user into opening a malicious email with a specially crafted attachment file name. This does only affect the Ubuntu 4.10 version, the Evolution package shipped with Ubuntu 5.04 is not affected. (CAN-2005-0806)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 5.04
evolution
Ubuntu 4.10
evolution

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

References