PT-2013-1408 · Gnome+3 · Gnome Evolution+3

Matt Mccutchen · CVE-2011-3201 · Published 2013-02-20 · Updated 2023-02-13

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GNOME Evolution versions prior to 3.2.3

Description The issue allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a "mailto:" URL, which attaches the file to the email. This enables attackers to access files on the user's system by manipulating the attachment parameter in a mailto URL.

Recommendations For versions prior to 3.2.3, update to version 3.2.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the attachment parameter in mailto URLs until the update is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CESA-2013_0516

CVE-2011-3201

RHSA-2013:0516

RHSA-2013_0516

Affected Products

Centos

Debian

Gnome Evolution

Red Hat

References · 26

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3201 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-0516.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3201 · Security Note
• https://git.gnome.org/browse/evolution/commit/?id=0a478083fa31aec0059bc6feacc054226fe55b56 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3201 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-3201 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3201 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/evolution · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=733504 · Vendor Advisory
• https://git.gnome.org/browse/evolution/commit/?id=588c410718068388f8ce0004a71c104a4c89cce3 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0516.html · Vendor Advisory
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/026776.html · Note
• https://lists.centos.org/pipermail/centos-announce/2013-March/056223.html · Note
• https://lists.centos.org/pipermail/centos-announce/2013-March/081466.html · Note
• https://lists.centos.org/pipermail/centos-cr-announce/2013-February/006706.html · Note