evolution security update

2008-06-0413:42:10

CentOS Project

lists.centos.org

7.6 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

0.102 Low

EPSS

Percentile

95.0%

JSON

CentOS Errata and Security Advisory CESA-2008:0516

Evolution is the integrated collection of e-mail, calendaring, contact
management, communications and personal information management (PIM) tools
for the GNOME desktop environment.

A flaw was found in the way Evolution parsed iCalendar timezone attachment
data. If mail which included a carefully crafted iCalendar attachment was
opened, arbitrary code could be executed as the user running Evolution.
(CVE-2008-1108)

Red Hat would like to thank Alin Rad Pop of Secunia Research for
responsibly disclosing this issue.

All users of Evolution should upgrade to these updated packages, which
contains a backported patch which resolves this issue.

Affected packages:
evolution
evolution-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2008:0516

OSVersionArchitecturePackageVersionFilename
CentOS4ia64evolution< 2.0.2-35.0.4.c4.2evolution-2.0.2-35.0.4.c4.2.ia64.rpm
CentOS4ia64evolution-devel< 2.0.2-35.0.4.c4.2evolution-devel-2.0.2-35.0.4.c4.2.ia64.rpm
CentOS3ia64evolution< 1.4.5-22.el3evolution-1.4.5-22.el3.ia64.rpm
CentOS3ia64evolution-devel< 1.4.5-22.el3evolution-devel-1.4.5-22.el3.ia64.rpm
CentOS4s390evolution< 2.0.2-35.0.4.c4.2evolution-2.0.2-35.0.4.c4.2.s390.rpm
CentOS4s390evolution-devel< 2.0.2-35.0.4.c4.2evolution-devel-2.0.2-35.0.4.c4.2.s390.rpm
CentOS4s390xevolution< 2.0.2-35.0.4.c4.2evolution-2.0.2-35.0.4.c4.2.s390x.rpm
CentOS4s390xevolution-devel< 2.0.2-35.0.4.c4.2evolution-devel-2.0.2-35.0.4.c4.2.s390x.rpm
CentOS3s390evolution< 1.4.5-22.el3evolution-1.4.5-22.el3.s390.rpm
CentOS3s390evolution-devel< 1.4.5-22.el3evolution-devel-1.4.5-22.el3.s390.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	4	ia64	evolution	< 2.0.2-35.0.4.c4.2	evolution-2.0.2-35.0.4.c4.2.ia64.rpm
CentOS	4	ia64	evolution-devel	< 2.0.2-35.0.4.c4.2	evolution-devel-2.0.2-35.0.4.c4.2.ia64.rpm
CentOS	3	ia64	evolution	< 1.4.5-22.el3	evolution-1.4.5-22.el3.ia64.rpm
CentOS	3	ia64	evolution-devel	< 1.4.5-22.el3	evolution-devel-1.4.5-22.el3.ia64.rpm
CentOS	4	s390	evolution	< 2.0.2-35.0.4.c4.2	evolution-2.0.2-35.0.4.c4.2.s390.rpm
CentOS	4	s390	evolution-devel	< 2.0.2-35.0.4.c4.2	evolution-devel-2.0.2-35.0.4.c4.2.s390.rpm
CentOS	4	s390x	evolution	< 2.0.2-35.0.4.c4.2	evolution-2.0.2-35.0.4.c4.2.s390x.rpm
CentOS	4	s390x	evolution-devel	< 2.0.2-35.0.4.c4.2	evolution-devel-2.0.2-35.0.4.c4.2.s390x.rpm
CentOS	3	s390	evolution	< 1.4.5-22.el3	evolution-1.4.5-22.el3.s390.rpm
CentOS	3	s390	evolution-devel	< 1.4.5-22.el3	evolution-devel-1.4.5-22.el3.s390.rpm