rpm package
opensuse/evolution-data-server&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/evolution-data-server&distro=openSUSE%20Tumbleweed
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-2604 | Med | 5.6 | < 3.58.3-2.1 | 3.58.3-2.1 | Jun 17, 2026 | A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact c | |
| CVE-2020-16117 | Med | 5.9 | < 3.40.4-1.4 | 3.40.4-1.4 | Jul 29, 2020 | In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server. | |
| CVE-2020-14928 | Med | 5.9 | < 3.40.4-1.4 | 3.40.4-1.4 | Jul 17, 2020 | evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection." | |
| CVE-2007-3257 | — | < 3.40.4-1.4 | 3.40.4-1.4 | Jun 19, 2007 | Camel (camel-imap-folder.c) in the mailer component for Evolution Data Server 1.11 allows remote IMAP servers to execute arbitrary code via a negative SEQUENCE value in GData, which is used as an array index. |
- affected < 3.58.3-2.1fixed 3.58.3-2.1
A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact c
- affected < 3.40.4-1.4fixed 3.40.4-1.4
In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.
- affected < 3.40.4-1.4fixed 3.40.4-1.4
evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."
- CVE-2007-3257Jun 19, 2007affected < 3.40.4-1.4fixed 3.40.4-1.4
Camel (camel-imap-folder.c) in the mailer component for Evolution Data Server 1.11 allows remote IMAP servers to execute arbitrary code via a negative SEQUENCE value in GData, which is used as an array index.