CVE-2020-16117: Null Pointer Dereference
In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapxfreecapability and imapxconnecttoserver.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-16117?
CVE-2020-16117 is a vulnerability in GNOME evolution-data-server before version 3.35.91 that allows a malicious server to crash the mail client with a NULL pointer dereference.
How does CVE-2020-16117 affect GNOME evolution-data-server?
CVE-2020-16117 affects GNOME evolution-data-server versions before 3.35.91.
How can a malicious server exploit CVE-2020-16117?
A malicious server can exploit CVE-2020-16117 by sending an invalid CAPABILITY line on a connection attempt.
What is the severity of CVE-2020-16117?
CVE-2020-16117 has a severity rating of medium, with a CVSS score of 5.9.
Are there any fixes available for CVE-2020-16117?
Yes, the vulnerability has been fixed in GNOME evolution-data-server version 3.35.91.