PT-2020-12913 · Gnome+2 · Gnome Evolution+2

Published 2020-03-15 · Updated 2023-08-22 · CVE-2020-11879

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GNOME Evolution versions prior to 3.35.91

Description An issue was discovered where a website or other source of mailto links can make Evolution attach local files or directories to a composed email message without showing a warning to the user. This is achieved by using the proprietary "mailto?attach=..." parameter, as demonstrated by an attach=. value.

Recommendations For versions prior to 3.35.91, update to version 3.35.91 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the "mailto?attach=..." parameter in mailto links until the issue is resolved.

Fix

Related Identifiers

ALT-PU-2020-1483

CVE-2020-11879

SUSE-SU-2023:3375-1

SUSE-SU-2023_3375-1

Affected Products

Alt Linux

Gnome Evolution

Suse

References · 16

• https://osv.dev/vulnerability/SUSE-SU-2023:3375-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11879 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-11879 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-11879 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11879 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11879 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-11879 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-11879 · Vendor Advisory
• https://gitlab.gnome.org/GNOME/evolution/issues/784 · Note
• https://gitlab.gnome.org/GNOME/evolution/-/commit/6489f20d6905cc797e2b2581c415e558c457caa7 · Note
• https://gitlab.gnome.org/GNOME/evolution/-/blob/master/NEWS · Note
• https://suse.com/security/cve/CVE-2020-11879 · Note
• https://bugzilla.suse.com/1169843 · Note
• https://bugzilla.suse.com/1213858 · Note
• https://suse.com/support/update/announcement/2023/suse-su-20233375-1 · Note