CVE-2009-0587
published 2009-03-14CVE-2009-0587: Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a…
PriorityP342high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
3.31%
87.2th percentile
Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | evolution-data-server | < evolution-data-server 2.22.3-1 (bookworm) | evolution-data-server 2.22.3-1 (bookworm) |
| gnome | evolution-data-server | >= 0 < 2.22.3-1 | 2.22.3-1 |
| gnome | evolution-data-server | >= 0 < 2.22.3-1 | 2.22.3-1 |
| gnome | evolution-data-server | >= 0 < 2.22.3-1 | 2.22.3-1 |
| gnome | evolution-data-server | >= 0 < 2.22.3-1 | 2.22.3-1 |
| go-evolution | evolution-data-server | <= 2.24.4 | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5MEDIUM
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f284-536x-2f8v: Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2
ghsa_unreviewed·2022-05-02
CVE-2009-0587 [HIGH] GHSA-f284-536x-2f8v: Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2
Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.
OSV
CVE-2009-0587: Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2
osv·2009-03-14·CVSS 7.5
CVE-2009-0587 [HIGH] CVE-2009-0587: Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2
Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.
Ubuntu
evolution-data-server vulnerability
vendor_ubuntu·2009-03-16
CVE-2009-0587 evolution-data-server vulnerability
Title: evolution-data-server vulnerability
Summary: evolution-data-server vulnerability
It was discovered that the Base64 encoding functions in
evolution-data-server did not properly handle large strings. If a user were
tricked into opening a specially crafted image file, or tricked into
connecting to a malicious server, an attacker could possibly execute
arbitrary code with user privileges.
Instructions: After a standard system upgrade you need to restart Evolution to effect
the necessary changes.
Red Hat
evolution-data-server: integer overflow in base64 encoding functions
vendor_redhat·2009-03-12·CVSS 7.5
CVE-2009-0587 [HIGH] CWE-190 evolution-data-server: integer overflow in base64 encoding functions
evolution-data-server: integer overflow in base64 encoding functions
Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.
Debian
CVE-2009-0587: evolution-data-server - Multiple integer overflows in Evolution Data Server (aka evolution-data-server) ...
vendor_debian·2009·CVSS 7.5
CVE-2009-0587 [HIGH] CVE-2009-0587: evolution-data-server - Multiple integer overflows in Evolution Data Server (aka evolution-data-server) ...
Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.
Scope: local
bookworm: resolved (fixed in 2.22.3-1)
bullseye: resolved (fixed in 2.22.3-1)
forky: resolved (fixed in 2.22.3-1)
sid: resolved (fixed in 2.22.3-1)
trixie: resolved (fixed in 2.22.3-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2009-0587 evolution-data-server: integer overflow in base64 encoding functions
bugzilla·2009-03-03·CVSS 4.6
CVE-2009-0587 [MEDIUM] CVE-2009-0587 evolution-data-server: integer overflow in base64 encoding functions
CVE-2009-0587 evolution-data-server: integer overflow in base64 encoding functions
Evolution Data Server contained multiple copies of base64_encode_simple function similar to one now implemented in glib2, that were affected by the glib2's CVE-2008-4316 integer overflow issue.
out = g_malloc (len * 4 / 3 + 5);
If the affected functions were used on large untrusted inputs, memory requirement computation may overflow, resulting in an insufficient memory allocation and heap-based buffer overflow during the base64 encode of the supplied data.
Affected code existed in:
- _evc_base64_encode_simple() in addressbook/libebook/e-vcard.c, can possibly be triggered by malicious LDAP address book backend
- camel_base64_encode_simple() in camel/camel-mime-utils.c, can possibly be triggered by NTLM
Bugzilla
CVE-2008-4316 glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
bugzilla·2008-12-05·CVSS 4.6
CVE-2008-4316 [MEDIUM] CVE-2008-4316 glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
CVE-2008-4316 glib2: integer overflows in the base64 handling functions (oCERT-2008-015)
oCERT team notified us about discovered by Diego Pettenò in glib:
Base64 encoding and decoding functions in glib suffer from vulnerabilities during memory allocations which may result in arbitrary code execution when processing large strings.
g_base64_encode and g_base64_decode allocate memory for their respective behavior using a similar pattern:
ret = g_malloc0 (input_length * 3 / 4);
In g_base64_decode, input_length is typed as a gint and its value is derived directly from a strlen(3) call over an input string. Since the multiplication is evaluated prior to the division, an input_length greater than (UINT_MAX/3), or 1431655765, will wrap resulting in smaller allocation than required. It is also
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.htmlhttp://ocert.org/patches/2008-015/camel-CVE-2009-0587.diffhttp://ocert.org/patches/2008-015/evc-CVE-2009-0587.diffhttp://openwall.com/lists/oss-security/2009/03/12/2http://osvdb.org/52702http://osvdb.org/52703http://secunia.com/advisories/34338http://secunia.com/advisories/34339http://secunia.com/advisories/34348http://secunia.com/advisories/34351http://secunia.com/advisories/35357http://www.debian.org/security/2009/dsa-1813http://www.mandriva.com/security/advisories?name=MDVSA-2009:078http://www.ocert.org/advisories/ocert-2008-015.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0354.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0355.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0358.htmlhttp://www.securityfocus.com/archive/1/501712/100/0/threadedhttp://www.securityfocus.com/bid/34100http://www.ubuntu.com/usn/USN-733-1https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11385http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.htmlhttp://ocert.org/patches/2008-015/camel-CVE-2009-0587.diffhttp://ocert.org/patches/2008-015/evc-CVE-2009-0587.diffhttp://openwall.com/lists/oss-security/2009/03/12/2http://osvdb.org/52702http://osvdb.org/52703http://secunia.com/advisories/34338http://secunia.com/advisories/34339http://secunia.com/advisories/34348http://secunia.com/advisories/34351http://secunia.com/advisories/35357http://www.debian.org/security/2009/dsa-1813http://www.mandriva.com/security/advisories?name=MDVSA-2009:078http://www.ocert.org/advisories/ocert-2008-015.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0354.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0355.htmlhttp://www.redhat.com/support/errata/RHSA-2009-0358.htmlhttp://www.securityfocus.com/archive/1/501712/100/0/threadedhttp://www.securityfocus.com/bid/34100http://www.ubuntu.com/usn/USN-733-1https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11385
2009-03-14
Published