Detections
Analytics
RHEL 3 / 4 : evolution (RHSA-2008:0516)
high Nessus Plugin ID 33098
Synopsis
The remote Red Hat host is missing one or more security updates.Description
Updated evolution packages that address a buffer overflow vulnerability are now available for Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4.This update has been rated as having critical security impact by the Red Hat Security Response Team.
Evolution is the integrated collection of e-mail, calendaring, contact management, communications and personal information management (PIM) tools for the GNOME desktop environment.
A flaw was found in the way Evolution parsed iCalendar timezone attachment data. If mail which included a carefully crafted iCalendar attachment was opened, arbitrary code could be executed as the user running Evolution. (CVE-2008-1108)
Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing this issue.
All users of Evolution should upgrade to these updated packages, which contains a backported patch which resolves this issue.
Solution
Update the affected evolution and / or evolution-devel packages.See Also
Plugin Details
Severity: High
ID: 33098
File Name: redhat-RHSA-2008-0516.nasl
Version: 1.25
Type: local
Agent: unix
Family: Red Hat Local Security Checks
Published: 6/5/2008
Updated: 1/14/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 5.6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:redhat:enterprise_linux:evolution, cpe:/o:redhat:enterprise_linux:3, p-cpe:/a:redhat:enterprise_linux:evolution-devel, cpe:/o:redhat:enterprise_linux:4, cpe:/o:redhat:enterprise_linux:4.6
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 6/4/2008
Vulnerability Publication Date: 6/4/2008
Reference Information
CVE: CVE-2008-1108
BID: 29527