Format string vulnerability in Evolution 1.4 through 2.3.6.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the calendar entries such as task lists, which are not properly handled when the user selects the Calendars tab.

A Debian bug report [1] brought to light the fact that Evolution does not create its data files with appropriate permissions. Because of this, if user A on a system uses Evolut ion for email, user B can read any of user A's email. The default permissions for ~/.evolution is 0755, and the default permissions for Evolution data files is 0644 (although s trangely enough the default permissions for .index files is 0600).

As well, by default in Fedora and RHEL5, a user's home directory has mode 0755 permissions.

By contrast, Firefox creates ~/.mozilla/firefox as mode 0700, protecting user bookmarks and caches.

Evolution should probably create/enforce ~/.evolution being mode 0700.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526409