CVE-2008-1109
published 2008-06-04CVE-2008-1109: Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar…
PriorityP344critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
5.75%
92.2th percentile
Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view (aka the Calendars window).
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | evolution | < evolution 2.22.2-1.1 (bookworm) | evolution 2.22.2-1.1 (bookworm) |
| gnome | evolution | — | — |
| gnome | evolution | >= 0 < 2.22.2-1.1 | 2.22.2-1.1 |
| gnome | evolution | >= 0 < 2.22.2-1.1 | 2.22.2-1.1 |
| gnome | evolution | >= 0 < 2.22.2-1.1 | 2.22.2-1.1 |
| gnome | evolution | >= 0 < 2.22.2-1.1 | 2.22.2-1.1 |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv9.3CRITICAL
vendor_debian9.3LOW
vendor_redhat9.3CRITICAL
vendor_ubuntu7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8h38-8v6v-579f: Heap-based buffer overflow in Evolution 2
ghsa_unreviewed·2022-05-01
CVE-2008-1109 [HIGH] CWE-119 GHSA-8h38-8v6v-579f: Heap-based buffer overflow in Evolution 2
Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view (aka the Calendars window).
OSV
CVE-2008-1109: Heap-based buffer overflow in Evolution 2
osv·2008-06-04·CVSS 9.3
CVE-2008-1109 [CRITICAL] CVE-2008-1109: Heap-based buffer overflow in Evolution 2
Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view (aka the Calendars window).
Ubuntu
Evolution vulnerabilities
vendor_ubuntu·2008-06-06·CVSS 7.6
CVE-2008-1108 [HIGH] Evolution vulnerabilities
Title: Evolution vulnerabilities
Summary: Evolution vulnerabilities
Alin Rad Pop of Secunia Research discovered that Evolution did not
properly validate timezone data when processing iCalendar attachments.
If a user disabled the ITip Formatter plugin and viewed a crafted
iCalendar attachment, an attacker could cause a denial of service or
possibly execute code with user privileges. Note that the ITip
Formatter plugin is enabled by default in Ubuntu. (CVE-2008-1108)
Alin Rad Pop of Secunia Research discovered that Evolution did not
properly validate the DESCRIPTION field when processing iCalendar
attachments. If a user were tricked into accepting a crafted
iCalendar attachment and replied to it from the calendar window, an
attacker code cause a denial of service or execute code with user
Red Hat
evolution: iCalendar buffer overflow via large description parameter
vendor_redhat·2008-06-04·CVSS 9.3
CVE-2008-1109 [CRITICAL] evolution: iCalendar buffer overflow via large description parameter
evolution: iCalendar buffer overflow via large description parameter
Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view (aka the Calendars window).
Debian
CVE-2008-1109: evolution - Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attac...
vendor_debian·2008·CVSS 9.3
CVE-2008-1109 [CRITICAL] CVE-2008-1109: evolution - Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attac...
Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view (aka the Calendars window).
Scope: local
bookworm: resolved (fixed in 2.22.2-1.1)
bullseye: resolved (fixed in 2.22.2-1.1)
forky: resolved (fixed in 2.22.2-1.1)
sid: resolved (fixed in 2.22.2-1.1)
trixie: resolved (fixed in 2.22.2-1.1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2008-1109 evolution: iCalendar buffer overflow via large description parameter
bugzilla·2008-05-27·CVSS 9.3
CVE-2008-1109 [CRITICAL] CVE-2008-1109 evolution: iCalendar buffer overflow via large description parameter
CVE-2008-1109 evolution: iCalendar buffer overflow via large description parameter
Alin Rad Pop of the Secunia Research discovered following issue affecting
evolution's iCalendar handling code:
A boundary error exists when replying to an iCalendar request while
in calendar view. This can be exploited to cause a heap-based buffer
overflow via an overly long "DESCRIPTION" property string included in an
iCalendar attachment.
Successful exploitation allows execution of arbitrary code, but requires
that the user accepts the iCalendar request and replies to it from the
"Calendars" window.
Vulnerability Details:
The vulnerability is present within the "html_new_lines_for()"
function in calendar/gui/itip-utils.c from line 190 on.
[calendar/gui/itip-utils.c:179]
char *html_string = (char *) ma
Bugzilla
CVE-2008-1108 evolution: iCalendar buffer overflow via large timezone specification
bugzilla·2008-05-27·CVSS 7.6
CVE-2008-1108 [HIGH] CVE-2008-1108 evolution: iCalendar buffer overflow via large timezone specification
CVE-2008-1108 evolution: iCalendar buffer overflow via large timezone specification
Alin Rad Pop of the Secunia Research discovered following issue affecting
evolution's iCalendar handling code:
A boundary error exists when parsing timezone strings contained
within iCalendar attachments. This can be exploited to overflow a static
buffer via an overly long timezone string.
Successful exploitation allows execution of arbitrary code, but requires
that the ITip Formatter plugin is disabled.
Vulnerability Details:
The vulnerability is present within the "write_label_piece()"
function in calendar/gui/e-itip-control.c at line 713, when the
extracted display name of the timezone is longer than the destination
buffer.
[calendar/gui/e-itip-control.c:713]
strcat(buffer, display_name);
Acknowled
http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00003.htmlhttp://secunia.com/advisories/30298http://secunia.com/advisories/30527http://secunia.com/advisories/30564http://secunia.com/advisories/30571http://secunia.com/advisories/30702http://secunia.com/advisories/30716http://secunia.com/secunia_research/2008-23/advisory/http://security.gentoo.org/glsa/glsa-200806-06.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:111http://www.redhat.com/support/errata/RHSA-2008-0514.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0515.htmlhttp://www.securityfocus.com/bid/29527http://www.securitytracker.com/id?1020170http://www.ubuntu.com/usn/usn-615-1http://www.vupen.com/english/advisories/2008/1732/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/42826https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10337https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00157.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-June/msg00178.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-June/msg00179.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-06/msg00003.htmlhttp://secunia.com/advisories/30298http://secunia.com/advisories/30527http://secunia.com/advisories/30564http://secunia.com/advisories/30571http://secunia.com/advisories/30702http://secunia.com/advisories/30716http://secunia.com/secunia_research/2008-23/advisory/http://security.gentoo.org/glsa/glsa-200806-06.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2008:111http://www.redhat.com/support/errata/RHSA-2008-0514.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0515.htmlhttp://www.securityfocus.com/bid/29527http://www.securitytracker.com/id?1020170http://www.ubuntu.com/usn/usn-615-1http://www.vupen.com/english/advisories/2008/1732/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/42826https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10337https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00157.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-June/msg00178.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-June/msg00179.html
2008-06-04
Published