CVE-2007-1002
published 2007-03-21CVE-2007-1002: Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview.c in Evolution Shared Memo 2.8.2.1, and possibly earlier…
PriorityP430medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
3.36%
87.4th percentile
Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview.c in Evolution Shared Memo 2.8.2.1, and possibly earlier versions, allows user-assisted remote attackers to execute arbitrary code via format specifiers in the categories of a crafted shared memo.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | evolution | < evolution 2.10.2-1 (bookworm) | evolution 2.10.2-1 (bookworm) |
| evolution | shared_memo | — | — |
| gnome | evolution | >= 0 < 2.10.2-1 | 2.10.2-1 |
| gnome | evolution | >= 0 < 2.10.2-1 | 2.10.2-1 |
| gnome | evolution | >= 0 < 2.10.2-1 | 2.10.2-1 |
| gnome | evolution | >= 0 < 2.10.2-1 | 2.10.2-1 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
evolution format string flaw
vendor_redhat·2007-03-28·CVSS 6.8
CVE-2007-1002 [MEDIUM] evolution format string flaw
evolution format string flaw
Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview.c in Evolution Shared Memo 2.8.2.1, and possibly earlier versions, allows user-assisted remote attackers to execute arbitrary code via format specifiers in the categories of a crafted shared memo.
Ubuntu
Evolution vulnerability
vendor_ubuntu·2007-03-26
CVE-2007-1002 Evolution vulnerability
Title: Evolution vulnerability
Summary: Evolution vulnerability
Ulf Harnhammar of Secunia Research discovered that Evolution did not
correctly handle format strings when displaying shared memos. If a
remote attacker tricked a user into viewing a specially crafted shared
memo, they could execute arbitrary code with user privileges.
Instructions: After a standard system upgrade you need to restart Evolution or reboot
your computer to effect the necessary changes.
Debian
CVE-2007-1002: evolution - Format string vulnerability in the write_html function in calendar/gui/e-cal-com...
vendor_debian·2007·CVSS 6.8
CVE-2007-1002 [MEDIUM] CVE-2007-1002: evolution - Format string vulnerability in the write_html function in calendar/gui/e-cal-com...
Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview.c in Evolution Shared Memo 2.8.2.1, and possibly earlier versions, allows user-assisted remote attackers to execute arbitrary code via format specifiers in the categories of a crafted shared memo.
Scope: local
bookworm: resolved (fixed in 2.10.2-1)
bullseye: resolved (fixed in 2.10.2-1)
forky: resolved (fixed in 2.10.2-1)
sid: resolved (fixed in 2.10.2-1)
trixie: resolved (fixed in 2.10.2-1)
GHSA
GHSA-h5rr-x7vv-j59h: Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview
ghsa_unreviewed·2022-05-01
CVE-2007-1002 [MEDIUM] GHSA-h5rr-x7vv-j59h: Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview
Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview.c in Evolution Shared Memo 2.8.2.1, and possibly earlier versions, allows user-assisted remote attackers to execute arbitrary code via format specifiers in the categories of a crafted shared memo.
OSV
CVE-2007-1002: Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview
osv·2007-03-21·CVSS 6.8
CVE-2007-1002 [MEDIUM] CVE-2007-1002: Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview
Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview.c in Evolution Shared Memo 2.8.2.1, and possibly earlier versions, allows user-assisted remote attackers to execute arbitrary code via format specifiers in the categories of a crafted shared memo.
No detection rules found.
Exploit-DB
smbftpd 0.96 - SMBDirList-function Remote Format String
exploitdb·2007-10-01
CVE-2007-5184 smbftpd 0.96 - SMBDirList-function Remote Format String
smbftpd 0.96 - SMBDirList-function Remote Format String
---
/*
* smbftpd 0.96 Proof of concept
* tested with smbftpd 0.96 compiled with gcc 3.3.6
*
* 1. write jumpcode to `BSS`
* mov dx, 0x1234
* pop eax
* cmp ax, dx
* jne $-4
* jmp esp
* 2. overwrite a GOT entry with the addr to `BSS` & send shellcode
*
* jerry:~> ./bleh -h localhost
* [+] GOT: 0x80591d8 - .bss (jmpcode): 0x805a791
* [+] localhost:21 (user: anonymous pass: )
* [+] PASV
* [+] writing jumpcode
* [+] PASV
* [+] overwriting GOT entry and sending shellcode
* jerry:~> nc localhost 4444
* id
* uid=0(root) gid=0(root) euid=1002(ftp) egid=1002(ftp) groups=1002(ftp)
*
*
* - Jerry Illikainen
*
*/
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define GOT 0x080591d8 // GOT entry for chdir
#define
Exploit-DB
SmartFTP Client 2.0.1002 - Remote Heap Overflow Denial of Service
exploitdb·2007-02-06
CVE-2007-0790 SmartFTP Client 2.0.1002 - Remote Heap Overflow Denial of Service
SmartFTP Client 2.0.1002 - Remote Heap Overflow Denial of Service
---
/***************************************************************************
* SmartFTP Client v 2.0.1002 Heap Overflow DoS *
* *
* *
* There is remote heap overflow in SmartFTP. When the app receives a long *
* banner (5000 char) the heap is smashed, leading to DoS and to code *
* execution. *
* *
* There are also two buffer overflow in the fields Address and Login. *
* I've reported this to Secunia but it seems they didn't think it was dan- *
* gerous cause they didn't publish anything about. However a simple drag'n *
* drop could compromise your system... *
* *
* Have Fun! *
* *
* Coded by Marsu *
***************************************************************************/
#include "winsock2.h"
#include "stdio.h"
Bugzilla
CVE-2007-1002 evolution format string flaw
bugzilla·2007-03-23·CVSS 6.8
CVE-2007-1002 [MEDIUM] CVE-2007-1002 evolution format string flaw
CVE-2007-1002 evolution format string flaw
Affects FC5, FC6
+++ This bug was initially created as a clone of Bug #231478 +++
Ulf Harnhammar, Secunia Research, discovered a format string flaw in the way
evolution displays a memo's categories. It is possible for an attacker to send
a specially crafted memo mail which could execute arbitrary code as the user
running evoluiton. This memo must be accepted form the email, then later viewed
by the victim. The attack requires a fair amount of user interaction to be
successful.
-- Additional comment from [email protected] on 2007-03-22 09:38 EST --
This flaw is now public:
http://marc.info/?l=bugtraq&m=117449439201881&w=2
Discussion:
Fixed in evolution-2.6.3-2.fc5 and evolution-2.8.3-2.fc6.
Bugzilla
CVE-2007-1002 evolution format string flaw
bugzilla·2007-03-08·CVSS 6.8
CVE-2007-1002 [MEDIUM] CVE-2007-1002 evolution format string flaw
CVE-2007-1002 evolution format string flaw
Ulf Harnhammar, Secunia Research, discovered a format string flaw in the way
evolution displays a memo's categories. It is possible for an attacker to send
a specially crafted memo mail which could execute arbitrary code as the user
running evoluiton. This memo must be accepted form the email, then later viewed
by the victim. The attack requires a fair amount of user interaction to be
successful.
Discussion:
This flaw is now public:
http://marc.info/?l=bugtraq&m=117449439201881&w=2
---
Created attachment 151221
Proposed patch
---
Thanks Josh. Just committed this upstream.
Working my way backwards through our distros...
---
Patch applied to evolution-2.8.0-33.0.1.el5.
---
An advisory has been issued which should help the problem
describ
http://secunia.com/advisories/24234http://secunia.com/advisories/24651http://secunia.com/advisories/24668http://secunia.com/advisories/25102http://secunia.com/advisories/25551http://secunia.com/advisories/25880http://secunia.com/secunia_research/2007-44/advisory/http://security.gentoo.org/glsa/glsa-200706-02.xmlhttp://www.debian.org/security/2007/dsa-1325http://www.mandriva.com/security/advisories?name=MDKSA-2007:070http://www.novell.com/linux/security/advisories/2007_15_sr.htmlhttp://www.securityfocus.com/archive/1/463406/100/0/threadedhttp://www.securityfocus.com/archive/1/464820/30/7170/threadedhttp://www.securityfocus.com/bid/23073http://www.securitytracker.com/id?1017808http://www.ubuntu.com/usn/usn-442-1http://www.vupen.com/english/advisories/2007/1058https://exchange.xforce.ibmcloud.com/vulnerabilities/33106https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10100https://rhn.redhat.com/errata/RHSA-2007-0158.htmlhttp://secunia.com/advisories/24234http://secunia.com/advisories/24651http://secunia.com/advisories/24668http://secunia.com/advisories/25102http://secunia.com/advisories/25551http://secunia.com/advisories/25880http://secunia.com/secunia_research/2007-44/advisory/http://security.gentoo.org/glsa/glsa-200706-02.xmlhttp://www.debian.org/security/2007/dsa-1325http://www.mandriva.com/security/advisories?name=MDKSA-2007:070http://www.novell.com/linux/security/advisories/2007_15_sr.htmlhttp://www.securityfocus.com/archive/1/463406/100/0/threadedhttp://www.securityfocus.com/archive/1/464820/30/7170/threadedhttp://www.securityfocus.com/bid/23073http://www.securitytracker.com/id?1017808http://www.ubuntu.com/usn/usn-442-1http://www.vupen.com/english/advisories/2007/1058https://exchange.xforce.ibmcloud.com/vulnerabilities/33106https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10100https://rhn.redhat.com/errata/RHSA-2007-0158.html
2007-03-21
Published