PT-2008-1729 · Evolution+1 · Evolution+1

Ulf Harnhammar · Published 2008-03-05 · Updated 2018-10-15 · CVE-2008-0072

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Evolution versions 2.12.3 and earlier

Description The issue allows remote attackers to execute arbitrary code via a crafted encrypted message. This is demonstrated using the Version field.

Recommendations For versions 2.12.3 and earlier, update to a version later than 2.12.3 to resolve the issue. As a temporary workaround, consider avoiding the use of encrypted messages until a patch is available.

Fix

RCE

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2008-0072

DSA-1512-1

RHSA-2008:0177

RHSA-2008:0178

RHSA-2008_0177

Affected Products

Evolution

Red Hat

References · 34

• http://secunia.com/secunia_research/2008-8/advisory · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0177.html · Vendor Advisory
• http://secunia.com/advisories/29210 · Vendor Advisory
• http://secunia.com/advisories/29163 · Vendor Advisory
• http://secunia.com/advisories/30491 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00195.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0072 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0178.html · Vendor Advisory
• http://secunia.com/advisories/29317 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00190.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:063 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0768/references · Vendor Advisory
• http://secunia.com/advisories/30437 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-0072 · Vendor Advisory
• http://secunia.com/advisories/29057 · Vendor Advisory