An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a bad randomness function. This allows the attacker to get valid sessions for arbitrary users, and optionally reset their password. Tested and confirmed in a default installation of version 7.2.3. Earlier versions are affected, possibly earlier major versions as well.

SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL commands into the "cfname" parameter when creating a new filter under the "Collections" tab.

Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name input field in the plugin module.

Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resource via redirectto parameter in emailpassthrough.php.

An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.

b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/callplugin.php.

GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.

Upstream issues : https://bugzilla.gnome.org/showbug.cgi?id=796424

Upstream Patch: https://gitlab.gnome.org/GNOME/evolution/commit/f66cd3e1db301d264563b4222a3574e2e58e2b85

DISPUTED addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because "the code had computed the required string length first, and then allocated a large-enough buffer on the heap."

The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.

Description of problem:

Hi,

this is actually not a RedHat/Fedora bug, it's an Evolution issue but the GNOME bugzilla doesn't seem to support reporting security/private bugs so Milan asked me to report here.

When selecting the key for GPG-encrypted mail, Evolution seems to do:

gpg --encrypt -r address

This is actually a bad idea, because it matches every userid including address (wether in the first or last name, in the comment or in the email address).

What makes it worse is that gpg returns the first match, so in case something else matches the email address given (for example name instead of first.name), then the mail will be encrypted to the wrong recipient. This looks like a security issue to me, thus marking it as such and reporting it. If you disagree, feel free to change that.

In the gpg manpage there's an explanation about how userid can be selected, and for example:

By exact match on an email address. This is indicated by enclosing the email address in the usual way with left and right angles.

<heinrichh>

So the angles should be added to the command line used by Evolution.

Note that this still won't work if multiple keys match that email address. Maybe Evolution should do the same as mutt, which seems to first search (using I guess gpg --list) the keys matching a query, then ask the user to select the uid. This would make sure the user actually knows to what recipient the mail is encrypted to.

And also note that, right now, there's no way to encrypt the mail to the correct recipient but to delete the key from the keyring.

Version-Release number of selected component (if applicable):

Evolution 3.8.2

How reproducible: Always

Steps to Reproduce: 1. create keys for multiple recipient with matching email addresses (test and foo-test) 2. try to write gpg encrypted mail to both addresses

Actual results:

Mail is always encrypted to the first matching user id.

Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or HTML via the message body.

SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter.

GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.

This is another Evolution security issue that I found upstream but presume also affects Fedora and would like to put on the Fedora security team's radar. If my filing such bugs is not appreciated, please let me know and I will stop.

Description of problem: Evolution registers a "mailto:" URL handler that accepts a parameter to attach a local file. Thus, a web site can launch the composer on an email with a confidential file attached and try to trick the user into sending it.

Version-Release number of selected component (if applicable): Upstream gnome-3-0 branch as of 2011-08-24

How reproducible: Always

Steps to Reproduce: 1. Go to https://mattmccutchen.net/private/evolution-mailto-test . 2. Click "Send" in the composer.

Actual results: Your SSH private key is emailed to me.

Expected results: A prompt is shown and you decline to attach the private key.

A flaw was found in bogofilter's/bogolexer's base64 where it could overwrite memory before its heap buffer, if the base64 input started with an equals sign, such as through misdeclaration of quoted-printable as base64. This would cause bogofilter/bogolexer to corrupt their heap and crash upon receiving such an email message.

Something is wrong with the bogofilter home page, the original referenced advisory [1] is currently unavailable, however a copy in svn [2] is. This will also be corrected in upstream version 1.2.2; a patch [3] is available. Please note that upstream version 1.2.2 is not yet available.

References:

[1] http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01 [2] http://bogofilter.svn.sourceforge.net/viewvc/bogofilter/trunk/bogofilter/doc/bogofilter-SA-2010-01?view=markup&pathrev=6909 [3] http://bogofilter.svn.sourceforge.net/viewvc/bogofilter/trunk/bogofilter/src/base64.c?view=patch&r1=6906&r2=6903

This affects bogofilter as shipped in Fedora 12 and 13, as well as EPEL5.

Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived from yTNEF. A crafted email could cause these applications to write data in arbitrary locations on the filesystem, crash, or potentially execute arbitrary code when decoding attachments.

A heap overflow flaw was found in a regular expression parser in the NSS library used to match common names in certificates. A malicious site could present a carefully crafted certificate in such a way as to trigger the heap overflow leading to a crash or possibly execute arbitrary code as the user running a browser such as firefox.

The overflow happens when the browser checks if the hostname of the site you are visiting matches the Common Name (CN) field of the presented certificate. This check (certTestHostName) only happens automatically if the certificate is one that is signed by a Certificate Authority you have previously trusted. If the attacker presents a malicious self-signed certificate, or one signed by an untrusted CA, the user is presented with a dialog box about the certificate before the vulnerable function is called. If the user chooses to accept the certificate then the vulnerable function is called and the heap overflow happens. So this issue does require slightly more user interaction to be exploited.

Co-incidentally, the handling of regular expressions for NSS versions 3.12.3 and above was changed to use a different and simpler regular expression routine which is not vulnerable to this issue. Therefore where a system has NSS 3.12.3 installed, it is not vulnerable to this issue by default. (Although it is possible to change Firefox back to use the old vulnerable library it is not something that is expected users to have done, and is not an obvious documented ability)

For Red Hat Enterprise Linux 5, Firefox uses the system provided NSS library. This library was updated to a versions greater than 3.12.3 by RHBA-2009:1161 on 20th July 2009. Therefore systems updated to RHBA-2009:1161 are protected by default from this issue.

For Red Hat Enterprise Linux 4, Firefox uses the system provided NSS library. This library is due to be updated to a version greater than 3.12.3 and this will probably happen within the week (so before the embargo lifts).

For Red Hat Enterprise Linux 3 we do not ship Firefox but instead SeaMonkey which provides the NSS library. SeaMonkey will need updating to correct this issue.

A man-in-the-middle-attack possibility was found in the way evolution handles the Secure / Multipurpose Internet Mail Extensions (S/MIME) mail messages. If the S/MIME email was sign, the email message subsequently modified, evolution would consider the S/MIME message signature to be valid even for such a modified message. An attacker could use this flaw to modify the emails (message integrity violation) between communicating part.

References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508479

Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view (aka the Calendars window).

Buffer overflow in Evolution 2.22.1, when the ITip Formatter plugin is disabled, allows remote attackers to execute arbitrary code via a long timezone string in an iCalendar attachment.

Format string vulnerability in the emfmultipartencrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.