DISPUTED GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and dispute whether Evolution is the best place to change this behavior.

A Debian bug report [1] brought to light the fact that Evolution does not create its data files with appropriate permissions. Because of this, if user A on a system uses Evolut ion for email, user B can read any of user A's email. The default permissions for ~/.evolution is 0755, and the default permissions for Evolution data files is 0644 (although s trangely enough the default permissions for .index files is 0600).

As well, by default in Fedora and RHEL5, a user's home directory has mode 0755 permissions.

By contrast, Firefox creates ~/.mozilla/firefox as mode 0700, protecting user bookmarks and caches.

Evolution should probably create/enforce ~/.evolution being mode 0700.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526409

Evolution 2.2.x and 2.3.x in GNOME 2.7 and 2.8, when "load images if sender in addressbook" is enabled, allows remote attackers to cause a denial of service (persistent crash) via a crafted "From" header that triggers an assert error in camel-internet-address.c when a null pointer is used.