CVE-2009-1631
published 2009-05-14CVE-2009-1631: The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under…
PriorityP45low2.1CVSS 2.0
AVLACLAuNCPINAN
EPSS
0.44%
35.7th percentile
The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | evolution | < evolution 2.29.90-1 (bookworm) | evolution 2.29.90-1 (bookworm) |
| gnome | evolution | <= 2.26.1 | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | — | — |
| gnome | evolution | >= 0 < 2.29.90-1 | 2.29.90-1 |
| gnome | evolution | >= 0 < 2.29.90-1 | 2.29.90-1 |
| gnome | evolution | >= 0 < 2.29.90-1 | 2.29.90-1 |
| gnome | evolution | >= 0 < 2.29.90-1 | 2.29.90-1 |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv2.1LOW
vendor_debian2.1LOW
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
evolution: insecure permissions on evolution mailbox folders
vendor_redhat·2009-05-01·CVSS 2.1
CVE-2009-1631 [LOW] evolution: insecure permissions on evolution mailbox folders
evolution: insecure permissions on evolution mailbox folders
The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files.
Statement: Red Hat does not consider this to be a security issue. By default, user home directories are created with mode 0700 permissions, which would not expose the ~/.evolution/ directory regardless of its own permissions.
If a user intentionally relaxes permissions on their home directory, they should be auditing all files and directories in order to not expose unwanted files to other local users.
Debian
CVE-2009-1631: evolution - The Mailer component in Evolution 2.26.1 and earlier uses world-readable permiss...
vendor_debian·2009·CVSS 2.1
CVE-2009-1631 [LOW] CVE-2009-1631: evolution - The Mailer component in Evolution 2.26.1 and earlier uses world-readable permiss...
The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files.
Scope: local
bookworm: resolved (fixed in 2.29.90-1)
bullseye: resolved (fixed in 2.29.90-1)
forky: resolved (fixed in 2.29.90-1)
sid: resolved (fixed in 2.29.90-1)
trixie: resolved (fixed in 2.29.90-1)
GHSA
GHSA-q8vh-phfc-qrw2: The Mailer component in Evolution 2
ghsa_unreviewed·2022-05-02
CVE-2009-1631 [LOW] GHSA-q8vh-phfc-qrw2: The Mailer component in Evolution 2
The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files.
OSV
CVE-2009-1631: The Mailer component in Evolution 2
osv·2009-05-14·CVSS 2.1
CVE-2009-1631 [LOW] CVE-2009-1631: The Mailer component in Evolution 2
The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files.
No detection rules found.
No public exploits indexed.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526409http://bugzilla.gnome.org/show_bug.cgi?id=581604http://www.openwall.com/lists/oss-security/2009/05/12/6http://www.securityfocus.com/bid/34921https://bugzilla.redhat.com/show_bug.cgi?id=498648http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526409http://bugzilla.gnome.org/show_bug.cgi?id=581604http://www.openwall.com/lists/oss-security/2009/05/12/6http://www.securityfocus.com/bid/34921https://bugzilla.redhat.com/show_bug.cgi?id=498648
2009-05-14
Published