evolution -- remote format string vulnerabilities

Description:

A SITIC Vulnerability Advisory reports:

Evolution suffers from several format string bugs when handling data from remote sources. These bugs lead to crashes or the execution of arbitrary assembly language code.

1. The first format string bug occurs when viewing the full vCard data attached to an e-mail message.
2. The second format string bug occurs when displaying contact data from remote LDAP servers.
3. The third format string bug occurs when displaying task list data from remote servers.
4. The fourth, and least serious, format string bug occurs when the user goes to the Calendars tab to save task list data that is vulnerable to problem 3 above. Other calendar entries that do not come from task lists are also affected.

References:

• BugTraq ID 14532
• CVE name CVE-2005-2549
• CVE name CVE-2005-2550
• URL: <http://www.sitic.se/eng/advisories_and_recommendations/sa05-001.html>

Affects:

• evolution >1.5 <2.2.3_1

Disclaimer: The data contained on this page is derived from the VuXML document, please refer to the the original document for copyright information. The author of portaudit makes no claim of authorship or ownership of any of the information contained herein.

If you have found a vulnerability in a FreeBSD port not listed in the database, please contact the FreeBSD Security Officer. Refer to "FreeBSD Security Information" for more information.