USN-69-1: Evolution vulnerability
24 January 2005
Evolution vulnerability
Releases
Details
Max Vozeler discovered an integer overflow in camel-lock-helper. An
user-supplied length value was not validated, so that a value of -1
caused a buffer allocation of 0 bytes; this buffer was then filled by
an arbitrary amount of user-supplied data.
A local attacker or a malicious POP3 server could exploit this to
execute arbitrary code with root privileges (because camel-lock-helper
is installed as setuid root).
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 4.10
-
evolution
-
In general, a standard system update will make all the necessary changes.