CVE-2008-0072
published 2008-03-06CVE-2008-0072: Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute…
PriorityP339medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
6.02%
92.5th percentile
Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | evolution | < evolution 2.12.3-1.1 (bookworm) | evolution 2.12.3-1.1 (bookworm) |
| gnome | evolution | <= 2.12.3 | — |
| gnome | evolution | >= 0 < 2.12.3-1.1 | 2.12.3-1.1 |
| gnome | evolution | >= 0 < 2.12.3-1.1 | 2.12.3-1.1 |
| gnome | evolution | >= 0 < 2.12.3-1.1 | 2.12.3-1.1 |
| gnome | evolution | >= 0 < 2.12.3-1.1 | 2.12.3-1.1 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Evolution format string flaw
vendor_redhat·2008-03-05·CVSS 6.8
CVE-2008-0072 [MEDIUM] Evolution format string flaw
Evolution format string flaw
Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.
Ubuntu
Evolution vulnerability
vendor_ubuntu·2008-03-05
CVE-2008-0072 Evolution vulnerability
Title: Evolution vulnerability
Summary: Evolution vulnerability
Ulf Harnhammar discovered that Evolution did not correctly handle format
strings when processing encrypted emails. A remote attacker could exploit
this by sending a specially crafted email, resulting in arbitrary code
execution.
Instructions: After a standard system upgrade you need to restart Evolution to effect
the necessary changes.
Debian
CVE-2008-0072: evolution - Format string vulnerability in the emf_multipart_encrypted function in mail/em-f...
vendor_debian·2008·CVSS 6.8
CVE-2008-0072 [MEDIUM] CVE-2008-0072: evolution - Format string vulnerability in the emf_multipart_encrypted function in mail/em-f...
Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.
Scope: local
bookworm: resolved (fixed in 2.12.3-1.1)
bullseye: resolved (fixed in 2.12.3-1.1)
forky: resolved (fixed in 2.12.3-1.1)
sid: resolved (fixed in 2.12.3-1.1)
trixie: resolved (fixed in 2.12.3-1.1)
GHSA
GHSA-j468-6fhg-5w3c: Format string vulnerability in the emf_multipart_encrypted function in mail/em-format
ghsa_unreviewed·2022-05-01
CVE-2008-0072 [MEDIUM] CWE-134 GHSA-j468-6fhg-5w3c: Format string vulnerability in the emf_multipart_encrypted function in mail/em-format
Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.
OSV
CVE-2008-0072: Format string vulnerability in the emf_multipart_encrypted function in mail/em-format
osv·2008-03-06·CVSS 6.8
CVE-2008-0072 [MEDIUM] CVE-2008-0072: Format string vulnerability in the emf_multipart_encrypted function in mail/em-format
Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00003.htmlhttp://secunia.com/advisories/29057http://secunia.com/advisories/29163http://secunia.com/advisories/29210http://secunia.com/advisories/29244http://secunia.com/advisories/29258http://secunia.com/advisories/29264http://secunia.com/advisories/29317http://secunia.com/advisories/30437http://secunia.com/advisories/30491http://secunia.com/secunia_research/2008-8/advisory/http://security.gentoo.org/glsa/glsa-200803-12.xmlhttp://wiki.rpath.com/wiki/Advisories:rPSA-2008-0105http://www.debian.org/security/2008/dsa-1512http://www.kb.cert.org/vuls/id/512491http://www.mandriva.com/security/advisories?name=MDVSA-2008:063http://www.redhat.com/support/errata/RHSA-2008-0177.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0178.htmlhttp://www.securityfocus.com/archive/1/492684/100/0/threadedhttp://www.securityfocus.com/bid/28102http://www.securitytracker.com/id?1019540http://www.ubuntu.com/usn/usn-583-1http://www.vupen.com/english/advisories/2008/0768/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/41011https://issues.rpath.com/browse/RPL-2310https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10701https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00190.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-March/msg00195.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-03/msg00003.htmlhttp://secunia.com/advisories/29057http://secunia.com/advisories/29163http://secunia.com/advisories/29210http://secunia.com/advisories/29244http://secunia.com/advisories/29258http://secunia.com/advisories/29264http://secunia.com/advisories/29317http://secunia.com/advisories/30437http://secunia.com/advisories/30491http://secunia.com/secunia_research/2008-8/advisory/http://security.gentoo.org/glsa/glsa-200803-12.xmlhttp://wiki.rpath.com/wiki/Advisories:rPSA-2008-0105http://www.debian.org/security/2008/dsa-1512http://www.kb.cert.org/vuls/id/512491http://www.mandriva.com/security/advisories?name=MDVSA-2008:063http://www.redhat.com/support/errata/RHSA-2008-0177.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0178.htmlhttp://www.securityfocus.com/archive/1/492684/100/0/threadedhttp://www.securityfocus.com/bid/28102http://www.securitytracker.com/id?1019540http://www.ubuntu.com/usn/usn-583-1http://www.vupen.com/english/advisories/2008/0768/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/41011https://issues.rpath.com/browse/RPL-2310https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10701https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00190.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-March/msg00195.html
2008-03-06
Published