CVE-2020-14928

CVE-2020-14928 affects evolution-data-server (EDS) up to version 3.36.3. The issue is a STARTTLS buffering flaw in SMTP/POP3: when a server sends a begin TLS response, EDS reads extra data and evaluates it in a TLS context, enabling potential response injection with impact on integrity as per the...

CVE-2020-16117

CVE-2020-16117 affects GNOME evolution-data-server, prior to 3.35.91. A malicious server can crash the mail client by sending an invalid CAPABILITY line during a connection, causing a NULL pointer dereference in the imapx_free_capability/imapx_connect_to_server path. The issue is a client-side cr...