Log in Start free

Vulnerability · Published Jul 29, 2020 · Assigned by mitre

CVE-2020-16117

Medium 5.9

In plain English

A medium-severity security flaw in the evolution-data-server-doc package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)2.1%top 18.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8evolution-data-server-doc3.28.5-15.el8ALSA-2021:1752
AlmaLinux:8evolution-data-server-perl3.28.5-15.el8ALSA-2021:1752
AlmaLinux:8evolution-data-server-tests3.28.5-15.el8ALSA-2021:1752
AlmaLinux:8evolution-devel3.28.5-16.el8ALSA-2021:1752
Debian:12evolution-data-server3.36.0-1DEBIAN-CVE-2020-16117
Debian:13evolution-data-server3.36.0-1DEBIAN-CVE-2020-16117
Debian:14evolution-data-server3.36.0-1DEBIAN-CVE-2020-16117
Rocky Linux:8evolution0:3.28.5-16.el8RLSA-2021:1752
Rocky Linux:8evolution-data-server0:3.28.5-15.el8RLSA-2021:1752
Rocky Linux:8evolution-ews0:3.28.5-10.el8RLSA-2021:1752

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References